diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
deleted file mode 100644
index 3237aa3..0000000
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
+++ /dev/null
@@ -1,376 +0,0 @@
-From 4e7c861c971ca49ea162bd908fef6021a62b9018 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Fri, 7 Oct 2022 10:46:29 +0800
-Subject: [PATCH 10/15] hostapd: mtk: Add DFS and ZWDFS support
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- hostapd/config_file.c        |  4 ++
- hostapd/ctrl_iface.c         | 95 ++++++++++++++++++++++++++++++++++++
- src/ap/ap_config.h           | 13 +++++
- src/ap/dfs.c                 | 35 +++++++------
- src/ap/dfs.h                 | 15 ++++++
- src/ap/hostapd.c             |  4 +-
- src/drivers/driver.h         |  7 +++
- src/drivers/driver_nl80211.c | 29 +++++++++++
- src/drivers/nl80211_copy.h   |  1 +
- 9 files changed, 186 insertions(+), 17 deletions(-)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 63c9d40be..cd1534952 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -4803,6 +4803,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
- 		int val = atoi(pos);
- 		conf->ibf_enable = !!val;
-+	} else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
-+		u8 en = strtol(pos, NULL, 10);
-+
-+		conf->dfs_detect_mode = en;
- 	} else {
- 		wpa_printf(MSG_ERROR,
- 			   "Line %d: unknown configuration item '%s'",
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index c881d3717..6ea1573b8 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -3522,6 +3522,96 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
- }
- 
- 
-+static int
-+hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
-+				       char *buf, size_t buflen)
-+{
-+	u8 dfs_detect_mode;
-+
-+	if (!value)
-+		return -1;
-+
-+	dfs_detect_mode = strtol(value, NULL, 10);
-+	if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
-+		wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
-+		return -1;
-+	}
-+	hapd->iconf->dfs_detect_mode = dfs_detect_mode;
-+
-+	return os_snprintf(buf, buflen, "OK\n");
-+}
-+
-+
-+static int
-+hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
-+				    char *buf, size_t buflen)
-+{
-+	struct hostapd_iface *iface = hapd->iface;
-+	char *pos, *param;
-+	enum hostapd_hw_mode hw_mode;
-+	bool chan_found = false;
-+	int i, num_available_chandefs, channel, chan_width, sec = 0;
-+	int sec_chan_idx_80p80 = -1;
-+	u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
-+	struct hostapd_channel_data *chan;
-+	enum dfs_channel_type type = DFS_NO_CAC_YET;
-+
-+	param = os_strchr(cmd, ' ');
-+	if (!param)
-+		return -1;
-+	*param++ = '\0';
-+
-+	pos = os_strstr(param, "chan=");
-+	if (pos)
-+		channel = strtol(pos + 5, NULL, 10);
-+	else
-+		return -1;
-+
-+	num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
-+	for (i = 0; i < num_available_chandefs; i++) {
-+		dfs_find_channel(iface, &chan, i, type);
-+		if (chan->chan == channel) {
-+			chan_found = true;
-+			break;
-+		}
-+	}
-+
-+	if (!chan_found)
-+		return -1;
-+
-+	if (iface->conf->secondary_channel)
-+		sec = 1;
-+
-+	dfs_adjust_center_freq(iface, chan,
-+			       sec,
-+			       sec_chan_idx_80p80,
-+			       &oper_centr_freq_seg0_idx,
-+			       &oper_centr_freq_seg1_idx);
-+
-+	if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
-+				  chan->freq, chan->chan,
-+				  iface->conf->ieee80211n,
-+				  iface->conf->ieee80211ac,
-+				  iface->conf->ieee80211ax,
-+				  iface->conf->ieee80211be,
-+				  sec, hostapd_get_oper_chwidth(iface->conf),
-+				  oper_centr_freq_seg0_idx,
-+				  oper_centr_freq_seg1_idx, true)) {
-+		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
-+		iface->radar_background.channel = -1;
-+		return -1;
-+	}
-+
-+	iface->radar_background.channel = chan->chan;
-+	iface->radar_background.freq = chan->freq;
-+	iface->radar_background.secondary_channel = sec;
-+	iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
-+	iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
-+
-+	return os_snprintf(buf, buflen, "OK\n");
-+}
-+
-+
- static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 					      char *buf, char *reply,
- 					      int reply_size,
-@@ -4081,6 +4171,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 		reply_len = hostapd_ctrl_iface_get_mu(hapd, reply, reply_size);
- 	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
- 		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
-+	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
-+		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
-+								   reply, reply_size);
-+	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
-+		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
- 	} else {
- 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
- 		reply_len = 16;
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9e3d2aeb..77f6169d2 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -1160,6 +1160,7 @@ struct hostapd_config {
- 	int *edcca_threshold;
- 	u8 three_wire_enable;
- 	u8 ibf_enable;
-+	u8 dfs_detect_mode;
- };
- 
- enum three_wire_mode {
-@@ -1174,6 +1175,18 @@ enum three_wire_mode {
- 		NUM_THREE_WIRE_MODE - 1
- };
- 
-+enum dfs_mode {
-+	DFS_DETECT_MODE_DISABLE,
-+	DFS_DETECT_MODE_AP_ENABLE,
-+	DFS_DETECT_MODE_BACKGROUND_ENABLE,
-+	DFS_DETECT_MODE_ALL_ENABLE,
-+
-+	/* keep last */
-+	NUM_DFS_DETECT_MODE,
-+	DFS_DETECT_MODE_MAX =
-+		NUM_DFS_DETECT_MODE - 1
-+};
-+
- enum edcca_mode {
- 	EDCCA_MODE_FORCE_DISABLE = 0,
- 	EDCCA_MODE_AUTO = 1,
-diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index b5d105d6a..1c3f6785b 100644
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -19,13 +19,6 @@
- #include "dfs.h"
- #include "crypto/crypto.h"
- 
--
--enum dfs_channel_type {
--	DFS_ANY_CHANNEL,
--	DFS_AVAILABLE, /* non-radar or radar-available */
--	DFS_NO_CAC_YET, /* radar-not-yet-available */
--};
--
- static struct hostapd_channel_data *
- dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
- 			u8 *oper_centr_freq_seg0_idx,
-@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
-  *  - hapd->vht/he_oper_centr_freq_seg0_idx
-  *  - hapd->vht/he_oper_centr_freq_seg1_idx
-  */
--static int dfs_find_channel(struct hostapd_iface *iface,
--			    struct hostapd_channel_data **ret_chan,
--			    int idx, enum dfs_channel_type type)
-+int dfs_find_channel(struct hostapd_iface *iface,
-+		     struct hostapd_channel_data **ret_chan,
-+		     int idx, enum dfs_channel_type type)
- {
- 	struct hostapd_hw_modes *mode;
- 	struct hostapd_channel_data *chan;
-@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
- }
- 
- 
--static void dfs_adjust_center_freq(struct hostapd_iface *iface,
--				   struct hostapd_channel_data *chan,
--				   int secondary_channel,
--				   int sec_chan_idx_80p80,
--				   u8 *oper_centr_freq_seg0_idx,
--				   u8 *oper_centr_freq_seg1_idx)
-+void dfs_adjust_center_freq(struct hostapd_iface *iface,
-+			    struct hostapd_channel_data *chan,
-+			    int secondary_channel,
-+			    int sec_chan_idx_80p80,
-+			    u8 *oper_centr_freq_seg0_idx,
-+			    u8 *oper_centr_freq_seg1_idx)
- {
- 	if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
- 		return;
-@@ -1317,6 +1310,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
- 		   __func__, iface->radar_background.cac_started ? "yes" : "no",
- 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
- 
-+	/* Skip channel switch when background dfs detect mode is on */
-+	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
-+	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
-+		return 0;
-+
- 	/* Check if CSA in progress */
- 	if (hostapd_csa_in_progress(iface))
- 		return 0;
-@@ -1365,6 +1363,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
- 		   __func__, iface->cac_started ? "yes" : "no",
- 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
- 
-+	/* Skip channel switch when dfs detect mode is on */
-+	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
-+	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
-+		return 0;
-+
- 	/* Check if CSA in progress */
- 	if (hostapd_csa_in_progress(iface))
- 		return 0;
-diff --git a/src/ap/dfs.h b/src/ap/dfs.h
-index 606c1b393..c2556d2d9 100644
---- a/src/ap/dfs.h
-+++ b/src/ap/dfs.h
-@@ -9,6 +9,12 @@
- #ifndef DFS_H
- #define DFS_H
- 
-+enum dfs_channel_type {
-+	DFS_ANY_CHANNEL,
-+	DFS_AVAILABLE, /* non-radar or radar-available */
-+	DFS_NO_CAC_YET, /* radar-not-yet-available */
-+};
-+
- int hostapd_handle_dfs(struct hostapd_iface *iface);
- 
- int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
-@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
- int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
- int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
- 			   int center_freq);
-+int dfs_find_channel(struct hostapd_iface *iface,
-+		     struct hostapd_channel_data **ret_chan,
-+		     int idx, enum dfs_channel_type type);
-+void dfs_adjust_center_freq(struct hostapd_iface *iface,
-+			    struct hostapd_channel_data *chan,
-+			    int secondary_channel,
-+			    int sec_chan_idx_80p80,
-+			    u8 *oper_centr_freq_seg0_idx,
-+			    u8 *oper_centr_freq_seg1_idx);
- 
- #endif /* DFS_H */
-diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index da7f7d87b..a0229c9ca 100644
---- a/src/ap/hostapd.c
-+++ b/src/ap/hostapd.c
-@@ -1464,7 +1464,9 @@ static int hostapd_setup_bss(struct hostapd_data *hapd, int first)
- 		return -1;
- 	}
- 
--	if (!conf->start_disabled && ieee802_11_set_beacon(hapd) < 0)
-+	if (conf->start_disabled)
-+		hapd->driver->start_disabled(hapd->drv_priv);
-+	else if (ieee802_11_set_beacon(hapd) < 0)
- 		return -1;
- 
- 	if (flush_old_stations && !conf->start_disabled &&
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 71ded617f..aa23fbdb3 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -4720,6 +4720,13 @@ struct wpa_driver_ops {
- 	 *
- 	 */
- 	int (*ibf_dump)(void *priv, u8 *ibf_enable);
-+
-+	/**
-+	 * start_disabled - set start_disabled to cfg80211
-+	 * @priv: Private driver interface data
-+	 *
-+	 */
-+	int (*start_disabled)(void *priv);
- };
- 
- /**
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 5c2a291ca..7472542cc 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -12776,6 +12776,34 @@ fail:
- 	return -ENOBUFS;
- }
- 
-+static int nl80211_start_disabled(void *priv)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_NEW_BEACON);
-+	if (!msg)
-+		goto fail;
-+
-+	if (nla_put_flag(msg, NL80211_ATTR_START_DISABLED))
-+		goto fail;
-+
-+	ret = send_and_recv_msgs_connect_handle(drv, msg, bss, 1);
-+
-+	if (ret)
-+		wpa_printf(MSG_ERROR, "Failed to set start_disabled. ret=%d (%s)",
-+			   ret, strerror(-ret));
-+
-+	return ret;
-+
-+fail:
-+	nlmsg_free(msg);
-+	return ret;
-+}
-+
- const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.name = "nl80211",
- 	.desc = "Linux nl80211/cfg80211",
-@@ -12930,4 +12958,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.three_wire_ctrl = nl80211_enable_three_wire,
- 	.ibf_ctrl = nl80211_ibf_enable,
- 	.ibf_dump = nl80211_ibf_dump,
-+	.start_disabled = nl80211_start_disabled,
- };
-diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index c4bf3ad35..79bc76c57 100644
---- a/src/drivers/nl80211_copy.h
-+++ b/src/drivers/nl80211_copy.h
-@@ -3176,6 +3176,7 @@ enum nl80211_attrs {
- 	NL80211_ATTR_EHT_CAPABILITY,
- 
- 	/* add attributes here, update the policy in nl80211.c */
-+	NL80211_ATTR_START_DISABLED = 999,
- 
- 	__NL80211_ATTR_AFTER_LAST,
- 	NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
new file mode 100644
index 0000000..2ceb639
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
@@ -0,0 +1,136 @@
+From 6828156c206701f5a0e5d30afcc514f452ce0ada Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 14:55:49 +0800
+Subject: [PATCH 10/16] hostapd: mtk: Add DFS detection mode
+
+Add DFS detection mode for testing radar detection rate.
+If DFS detection mode is on, AP will not switch channels when receiving
+a radar signal.
+This detection mode also supports background chain.
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c |  4 ++++
+ hostapd/ctrl_iface.c  | 23 +++++++++++++++++++++++
+ src/ap/ap_config.h    | 13 +++++++++++++
+ src/ap/dfs.c          | 10 ++++++++++
+ 4 files changed, 50 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 63c9d40..cd15349 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4803,6 +4803,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
+ 		int val = atoi(pos);
+ 		conf->ibf_enable = !!val;
++	} else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
++		u8 en = strtol(pos, NULL, 10);
++
++		conf->dfs_detect_mode = en;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c881d37..0b4c234 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3522,6 +3522,26 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
++				       char *buf, size_t buflen)
++{
++	u8 dfs_detect_mode;
++
++	if (!value)
++		return -1;
++
++	dfs_detect_mode = strtol(value, NULL, 10);
++	if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
++		wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
++		return -1;
++	}
++	hapd->iconf->dfs_detect_mode = dfs_detect_mode;
++
++	return os_snprintf(buf, buflen, "OK\n");
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4081,6 +4101,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ 	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
+ 		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
++	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
++		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
++								   reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index a9e3d2a..77f6169 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1160,6 +1160,7 @@ struct hostapd_config {
+ 	int *edcca_threshold;
+ 	u8 three_wire_enable;
+ 	u8 ibf_enable;
++	u8 dfs_detect_mode;
+ };
+ 
+ enum three_wire_mode {
+@@ -1174,6 +1175,18 @@ enum three_wire_mode {
+ 		NUM_THREE_WIRE_MODE - 1
+ };
+ 
++enum dfs_mode {
++	DFS_DETECT_MODE_DISABLE,
++	DFS_DETECT_MODE_AP_ENABLE,
++	DFS_DETECT_MODE_BACKGROUND_ENABLE,
++	DFS_DETECT_MODE_ALL_ENABLE,
++
++	/* keep last */
++	NUM_DFS_DETECT_MODE,
++	DFS_DETECT_MODE_MAX =
++		NUM_DFS_DETECT_MODE - 1
++};
++
+ enum edcca_mode {
+ 	EDCCA_MODE_FORCE_DISABLE = 0,
+ 	EDCCA_MODE_AUTO = 1,
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index b5d105d..5cb7799 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1317,6 +1317,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ 		   __func__, iface->radar_background.cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when background dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+@@ -1365,6 +1370,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
+ 		   __func__, iface->cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
new file mode 100644
index 0000000..1d8baf8
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
@@ -0,0 +1,192 @@
+From 88dd3df28e3736af4cca0daf4f7d19ab888ea6c4 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 14:56:55 +0800
+Subject: [PATCH 11/16] hostapd: mtk: Add DFS offchan channel switch
+
+Add DFS background chain channel switch command for testing purpose.
+This feature is implemented via hostapd_cli command.
+Command format:
+hostapd_cli -i <interface> raw SET_OFFCHAN_CTRL chan=<dfs_channel>
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 72 ++++++++++++++++++++++++++++++++++++++++++++
+ src/ap/dfs.c         | 25 ++++++---------
+ src/ap/dfs.h         | 15 +++++++++
+ 3 files changed, 96 insertions(+), 16 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 0b4c234..6ea1573 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3542,6 +3542,76 @@ hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
++				    char *buf, size_t buflen)
++{
++	struct hostapd_iface *iface = hapd->iface;
++	char *pos, *param;
++	enum hostapd_hw_mode hw_mode;
++	bool chan_found = false;
++	int i, num_available_chandefs, channel, chan_width, sec = 0;
++	int sec_chan_idx_80p80 = -1;
++	u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
++	struct hostapd_channel_data *chan;
++	enum dfs_channel_type type = DFS_NO_CAC_YET;
++
++	param = os_strchr(cmd, ' ');
++	if (!param)
++		return -1;
++	*param++ = '\0';
++
++	pos = os_strstr(param, "chan=");
++	if (pos)
++		channel = strtol(pos + 5, NULL, 10);
++	else
++		return -1;
++
++	num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
++	for (i = 0; i < num_available_chandefs; i++) {
++		dfs_find_channel(iface, &chan, i, type);
++		if (chan->chan == channel) {
++			chan_found = true;
++			break;
++		}
++	}
++
++	if (!chan_found)
++		return -1;
++
++	if (iface->conf->secondary_channel)
++		sec = 1;
++
++	dfs_adjust_center_freq(iface, chan,
++			       sec,
++			       sec_chan_idx_80p80,
++			       &oper_centr_freq_seg0_idx,
++			       &oper_centr_freq_seg1_idx);
++
++	if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
++				  chan->freq, chan->chan,
++				  iface->conf->ieee80211n,
++				  iface->conf->ieee80211ac,
++				  iface->conf->ieee80211ax,
++				  iface->conf->ieee80211be,
++				  sec, hostapd_get_oper_chwidth(iface->conf),
++				  oper_centr_freq_seg0_idx,
++				  oper_centr_freq_seg1_idx, true)) {
++		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
++		iface->radar_background.channel = -1;
++		return -1;
++	}
++
++	iface->radar_background.channel = chan->chan;
++	iface->radar_background.freq = chan->freq;
++	iface->radar_background.secondary_channel = sec;
++	iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
++	iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
++
++	return os_snprintf(buf, buflen, "OK\n");
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4104,6 +4174,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
+ 		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
+ 								   reply, reply_size);
++	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
++		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 5cb7799..1c3f678 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -19,13 +19,6 @@
+ #include "dfs.h"
+ #include "crypto/crypto.h"
+ 
+-
+-enum dfs_channel_type {
+-	DFS_ANY_CHANNEL,
+-	DFS_AVAILABLE, /* non-radar or radar-available */
+-	DFS_NO_CAC_YET, /* radar-not-yet-available */
+-};
+-
+ static struct hostapd_channel_data *
+ dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
+ 			u8 *oper_centr_freq_seg0_idx,
+@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
+  *  - hapd->vht/he_oper_centr_freq_seg0_idx
+  *  - hapd->vht/he_oper_centr_freq_seg1_idx
+  */
+-static int dfs_find_channel(struct hostapd_iface *iface,
+-			    struct hostapd_channel_data **ret_chan,
+-			    int idx, enum dfs_channel_type type)
++int dfs_find_channel(struct hostapd_iface *iface,
++		     struct hostapd_channel_data **ret_chan,
++		     int idx, enum dfs_channel_type type)
+ {
+ 	struct hostapd_hw_modes *mode;
+ 	struct hostapd_channel_data *chan;
+@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
+ }
+ 
+ 
+-static void dfs_adjust_center_freq(struct hostapd_iface *iface,
+-				   struct hostapd_channel_data *chan,
+-				   int secondary_channel,
+-				   int sec_chan_idx_80p80,
+-				   u8 *oper_centr_freq_seg0_idx,
+-				   u8 *oper_centr_freq_seg1_idx)
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++			    struct hostapd_channel_data *chan,
++			    int secondary_channel,
++			    int sec_chan_idx_80p80,
++			    u8 *oper_centr_freq_seg0_idx,
++			    u8 *oper_centr_freq_seg1_idx)
+ {
+ 	if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
+ 		return;
+diff --git a/src/ap/dfs.h b/src/ap/dfs.h
+index 606c1b3..c2556d2 100644
+--- a/src/ap/dfs.h
++++ b/src/ap/dfs.h
+@@ -9,6 +9,12 @@
+ #ifndef DFS_H
+ #define DFS_H
+ 
++enum dfs_channel_type {
++	DFS_ANY_CHANNEL,
++	DFS_AVAILABLE, /* non-radar or radar-available */
++	DFS_NO_CAC_YET, /* radar-not-yet-available */
++};
++
+ int hostapd_handle_dfs(struct hostapd_iface *iface);
+ 
+ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+ int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
+ int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
+ 			   int center_freq);
++int dfs_find_channel(struct hostapd_iface *iface,
++		     struct hostapd_channel_data **ret_chan,
++		     int idx, enum dfs_channel_type type);
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++			    struct hostapd_channel_data *chan,
++			    int secondary_channel,
++			    int sec_chan_idx_80p80,
++			    u8 *oper_centr_freq_seg0_idx,
++			    u8 *oper_centr_freq_seg1_idx);
+ 
+ #endif /* DFS_H */
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
similarity index 92%
rename from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
rename to recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
index dba90d1..7db3ae2 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
@@ -1,7 +1,7 @@
-From bc0722ebc1cc08be6239879fddaef37e0db2d9e0 Mon Sep 17 00:00:00 2001
+From d0128fc60d38ce4f20f8368bdc5ea9ed19a329b7 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 16 Dec 2022 03:57:11 +0800
-Subject: [PATCH 11/15] hostapd: mtk: Add amsdu set get ctrl
+Subject: [PATCH 12/16] hostapd: mtk: Add amsdu set get ctrl
 
 ---
  hostapd/config_file.c             |   9 +++
@@ -20,7 +20,7 @@
  13 files changed, 207 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd1534952..10ea52518 100644
+index cd15349..10ea525 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4807,6 +4807,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -40,7 +40,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 6ea1573b8..0ad8451aa 100644
+index 6ea1573..0ad8451 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3612,6 +3612,30 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
@@ -84,7 +84,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index c2a123a8c..30b3392e6 100644
+index c2a123a..30b3392 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1593,6 +1593,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
@@ -111,7 +111,7 @@
  };
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 7a96cb8b2..85ad5e444 100644
+index 7a96cb8..85ad5e4 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -299,6 +299,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -123,7 +123,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 77f6169d2..a9ac39619 100644
+index 77f6169..a9ac396 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1161,6 +1161,7 @@ struct hostapd_config {
@@ -135,7 +135,7 @@
  
  enum three_wire_mode {
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 60ae8253b..1a82f234c 100644
+index 60ae825..1a82f23 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1077,4 +1077,18 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
@@ -159,7 +159,7 @@
  }
 \ No newline at end of file
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index ab9aedcee..4406666fd 100644
+index ab9aedc..4406666 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -147,6 +147,8 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff);
@@ -172,10 +172,10 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index a0229c9ca..152060db4 100644
+index da7f7d8..a18e744 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -2310,6 +2310,8 @@ dfs_offload:
+@@ -2308,6 +2308,8 @@ dfs_offload:
  		goto fail;
  	if (hostapd_drv_ibf_ctrl(hapd) < 0)
  		goto fail;
@@ -185,7 +185,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 4050cf886..0999ea9e2 100644
+index 4050cf8..0999ea9 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -167,7 +167,6 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -220,13 +220,13 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index aa23fbdb3..b07aaf3fe 100644
+index 71ded61..265d86d 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -4727,6 +4727,15 @@ struct wpa_driver_ops {
+@@ -4720,6 +4720,15 @@ struct wpa_driver_ops {
  	 *
  	 */
- 	int (*start_disabled)(void *priv);
+ 	int (*ibf_dump)(void *priv, u8 *ibf_enable);
 +
 +	/**
 +	 * amsdu_ctrl - enable/disable amsdu
@@ -240,11 +240,11 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 7472542cc..6702384ef 100644
+index 5c2a291..d91b29c 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -12804,6 +12804,118 @@ fail:
- 	return ret;
+@@ -12776,6 +12776,118 @@ fail:
+ 	return -ENOBUFS;
  }
  
 +static int nl80211_enable_amsdu(void *priv, u8 amsdu)
@@ -362,15 +362,15 @@
  const struct wpa_driver_ops wpa_driver_nl80211_ops = {
  	.name = "nl80211",
  	.desc = "Linux nl80211/cfg80211",
-@@ -12959,4 +13071,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+@@ -12930,4 +13042,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.three_wire_ctrl = nl80211_enable_three_wire,
  	.ibf_ctrl = nl80211_ibf_enable,
  	.ibf_dump = nl80211_ibf_dump,
- 	.start_disabled = nl80211_start_disabled,
 +	.amsdu_ctrl = nl80211_enable_amsdu,
 +	.amsdu_dump = nl80211_dump_amsdu,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 607592ceb..e57022409 100644
+index 607592c..e570224 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -185,6 +185,7 @@ struct wpa_driver_nl80211_data {
@@ -382,7 +382,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 9ecc0ff9a..fcfa68bf7 100644
+index 9ecc0ff..fcfa68b 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1065,6 +1065,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -396,5 +396,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
similarity index 90%
rename from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch
rename to recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
index 63101e0..4df0ba6 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
@@ -1,7 +1,7 @@
-From b49ce922afa13fe8ea5d847753dfb7641b70c9a4 Mon Sep 17 00:00:00 2001
+From ebbf23ac8c19224b34523e8b9820e32f0789fe11 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 12 Jan 2023 15:18:19 +0800
-Subject: [PATCH 12/15] hostapd: mtk: Add he_ldpc configuration
+Subject: [PATCH 13/16] hostapd: mtk: Add he_ldpc configuration
 
 ---
  hostapd/config_file.c        | 2 ++
@@ -13,7 +13,7 @@
  6 files changed, 19 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 10ea52518..4237a5cca 100644
+index 10ea525..4237a5c 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -3508,6 +3508,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -26,7 +26,7 @@
  		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
  		conf->he_op.he_bss_color_disabled = 0;
 diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
-index ea67aa100..e3a5eb365 100644
+index ea67aa1..e3a5eb3 100644
 --- a/hostapd/hostapd.conf
 +++ b/hostapd/hostapd.conf
 @@ -830,6 +830,11 @@ wmm_ac_vo_acm=0
@@ -42,7 +42,7 @@
  #he_bss_color=1
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 85ad5e444..b283de624 100644
+index 85ad5e4..b283de6 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -268,6 +268,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -54,7 +54,7 @@
  		HE_OPERATION_RTS_THRESHOLD_OFFSET;
  	/* Set default basic MCS/NSS set to single stream MCS 0-7 */
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9ac39619..b8b20a7aa 100644
+index a9ac396..b8b20a7 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -929,6 +929,7 @@ struct hostapd_bss_config {
@@ -66,7 +66,7 @@
  	bool he_su_beamformee;
  	bool he_mu_beamformer;
 diff --git a/src/ap/ieee802_11_he.c b/src/ap/ieee802_11_he.c
-index b5b7e5d46..f27aeb196 100644
+index b5b7e5d..f27aeb1 100644
 --- a/src/ap/ieee802_11_he.c
 +++ b/src/ap/ieee802_11_he.c
 @@ -138,6 +138,13 @@ u8 * hostapd_eid_he_capab(struct hostapd_data *hapd, u8 *eid,
@@ -84,7 +84,7 @@
  		cap->he_phy_capab_info[HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX] |=
  			HE_PHYCAP_SU_BEAMFORMER_CAPAB;
 diff --git a/src/common/ieee802_11_defs.h b/src/common/ieee802_11_defs.h
-index 65e125e83..62088bda6 100644
+index 65e125e..62088bd 100644
 --- a/src/common/ieee802_11_defs.h
 +++ b/src/common/ieee802_11_defs.h
 @@ -2298,6 +2298,9 @@ struct ieee80211_spatial_reuse {
@@ -98,5 +98,5 @@
  #define HE_PHYCAP_SU_BEAMFORMER_CAPAB		((u8) BIT(7))
  #define HE_PHYCAP_SU_BEAMFORMEE_CAPAB_IDX	4
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
similarity index 89%
rename from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
rename to recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
index 1222510..f0d25c6 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
@@ -1,7 +1,7 @@
-From 52a1775318c9926a1dbf4f7c563e95b5be3c9bd6 Mon Sep 17 00:00:00 2001
+From bb5cb086162828392a04820063ad7997d8ae26d7 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 17 Jan 2023 13:25:18 +0800
-Subject: [PATCH 13/15] hostapd: mtk: Add the broadcast destination address of
+Subject: [PATCH 14/16] hostapd: mtk: Add the broadcast destination address of
  Probe Response frame on 6 GHz
 
 According to IEEE 802.11ax 26.17.2.3.2,
@@ -19,7 +19,7 @@
  1 file changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 1a26f11ff..f3ea5c277 100644
+index 1a26f11..f3ea5c2 100644
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
 @@ -1156,8 +1156,13 @@ void handle_probe_req(struct hostapd_data *hapd,
@@ -39,5 +39,5 @@
  		return;
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
similarity index 79%
rename from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
rename to recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
index 3689f74..5fcd0c5 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
@@ -1,7 +1,7 @@
-From 7d741c99f2e211abe70593ff6e8265633bed0d8a Mon Sep 17 00:00:00 2001
+From 1db373190399a907b27141c199841aeafd4643da Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Tue, 24 Jan 2023 19:06:44 +0800
-Subject: [PATCH 14/15] hostapd: mtk: Add vendor command attribute for RTS BW
+Subject: [PATCH 15/16] hostapd: mtk: Add vendor command attribute for RTS BW
  signaling.
 
 Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9e2..fb12895ce 100644
+index 0999ea9..fb12895 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -169,6 +169,7 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -22,5 +22,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
similarity index 76%
rename from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch
rename to recipes-wifi/hostapd/files/patches-2.10.3/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
index 642c625..33fea78 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
@@ -1,14 +1,14 @@
-From 619075bb430c908c61a818c45e36f1ca76020741 Mon Sep 17 00:00:00 2001
+From efa1d271d28c84b8ca77ffc3ca7cb75e727088a0 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 13 Feb 2023 11:03:53 +0800
-Subject: [PATCH 15/15] hostapd: mtk: 6G band does not require DFS
+Subject: [PATCH 16/16] hostapd: mtk: 6G band does not require DFS
 
 ---
  src/ap/dfs.c | 1 +
  1 file changed, 1 insertion(+)
 
 diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index 1c3f6785b..4b1e64246 100644
+index 1c3f678..4b1e642 100644
 --- a/src/ap/dfs.c
 +++ b/src/ap/dfs.c
 @@ -1506,6 +1506,7 @@ int hostapd_is_dfs_required(struct hostapd_iface *iface)
@@ -20,5 +20,5 @@
  		return 0;
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
new file mode 100644
index 0000000..265c37a
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
@@ -0,0 +1,46 @@
+From f6bfd9a4a6c0d08e0dec9311873c9e863a07c9a8 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 11:01:18 +0800
+Subject: [PATCH] hostapd: mtk: Fix sending wrong VHT operation IE in CSA while
+ using ZWDFS
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ src/ap/dfs.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 4b1e642..307a4e1 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1110,6 +1110,14 @@ static int
+ hostapd_dfs_start_channel_switch_background(struct hostapd_iface *iface)
+ {
+ 	u8 current_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
++	int ret;
++
++	ret = hostapd_dfs_request_channel_switch(iface, iface->radar_background.channel,
++						 iface->radar_background.freq,
++						 iface->radar_background.secondary_channel,
++						 current_vht_oper_chwidth,
++						 iface->radar_background.centr_freq_seg0_idx,
++						 iface->radar_background.centr_freq_seg1_idx);
+ 
+ 	iface->conf->channel = iface->radar_background.channel;
+ 	iface->freq = iface->radar_background.freq;
+@@ -1122,11 +1130,7 @@ hostapd_dfs_start_channel_switch_background(struct hostapd_iface *iface)
+ 
+ 	hostpad_dfs_update_background_chain(iface);
+ 
+-	return hostapd_dfs_request_channel_switch(
+-		iface, iface->conf->channel, iface->freq,
+-		iface->conf->secondary_channel, current_vht_oper_chwidth,
+-		hostapd_get_oper_centr_freq_seg0_idx(iface->conf),
+-		hostapd_get_oper_centr_freq_seg1_idx(iface->conf));
++	return ret;
+ }
+ 
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
new file mode 100644
index 0000000..db3c813
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
@@ -0,0 +1,189 @@
+From 3337e7b4f75a66e53e1320e49deba2b58a8a80b0 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 10:51:47 +0800
+Subject: [PATCH 18/19] hostapd: mtk: Add sta-assisted DFS state update
+ mechanism
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ src/ap/dfs.c                       | 20 ++++++++++++++++++++
+ src/ap/dfs.h                       |  3 +++
+ src/ap/drv_callbacks.c             | 28 ++++++++++++++++++++++++++++
+ src/common/wpa_ctrl.h              |  1 +
+ src/drivers/driver.h               | 14 ++++++++++++++
+ src/drivers/driver_nl80211_event.c |  6 ++++++
+ src/drivers/nl80211_copy.h         |  6 ++++++
+ 7 files changed, 78 insertions(+)
+
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 307a4e1..d082fe0 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1503,6 +1503,26 @@ int hostapd_dfs_nop_finished(struct hostapd_iface *iface, int freq,
+ }
+ 
+ 
++int hostapd_dfs_sta_update_state(struct hostapd_iface *iface, int freq,
++				 int ht_enabled, int chan_offset, int chan_width,
++				 int cf1, int cf2, u32 state)
++{
++	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_STA_UPDATE
++		"freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d state=%s",
++		freq, ht_enabled, chan_offset, chan_width, cf1, cf2,
++		(state == HOSTAPD_CHAN_DFS_AVAILABLE) ? "available" : "usable");
++
++	/* Proceed only if DFS is not offloaded to the driver */
++	if (iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD)
++		return 0;
++
++	set_dfs_state(iface, freq, ht_enabled, chan_offset, chan_width,
++		      cf1, cf2, state);
++
++	return 0;
++}
++
++
+ int hostapd_is_dfs_required(struct hostapd_iface *iface)
+ {
+ 	int n_chans, n_chans1, start_chan_idx, start_chan_idx1, res;
+diff --git a/src/ap/dfs.h b/src/ap/dfs.h
+index c2556d2..25ba29c 100644
+--- a/src/ap/dfs.h
++++ b/src/ap/dfs.h
+@@ -30,6 +30,9 @@ int hostapd_dfs_radar_detected(struct hostapd_iface *iface, int freq,
+ int hostapd_dfs_nop_finished(struct hostapd_iface *iface, int freq,
+ 			     int ht_enabled,
+ 			     int chan_offset, int chan_width, int cf1, int cf2);
++int hostapd_dfs_sta_update_state(struct hostapd_iface *iface, int freq,
++				 int ht_enabled, int chan_offset, int chan_width,
++				 int cf1, int cf2, u32 state);
+ int hostapd_is_dfs_required(struct hostapd_iface *iface);
+ int hostapd_is_dfs_chan_available(struct hostapd_iface *iface);
+ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+diff --git a/src/ap/drv_callbacks.c b/src/ap/drv_callbacks.c
+index 09783cb..275f6b3 100644
+--- a/src/ap/drv_callbacks.c
++++ b/src/ap/drv_callbacks.c
+@@ -1790,6 +1790,24 @@ static void hostapd_event_dfs_cac_started(struct hostapd_data *hapd,
+ 			      radar->cf1, radar->cf2);
+ }
+ 
++static void hostapd_event_dfs_sta_cac_skipped(struct hostapd_data *hapd,
++					      struct dfs_event *radar)
++{
++	wpa_printf(MSG_DEBUG, "DFS CAC skipped (by STA) on %d MHz", radar->freq);
++	hostapd_dfs_sta_update_state(hapd->iface, radar->freq, radar->ht_enabled,
++				     radar->chan_offset, radar->chan_width,
++				     radar->cf1, radar->cf2, HOSTAPD_CHAN_DFS_AVAILABLE);
++}
++
++static void hostapd_event_dfs_sta_cac_expired(struct hostapd_data *hapd,
++					      struct dfs_event *radar)
++{
++	wpa_printf(MSG_DEBUG, "DFS CAC expired (by STA) on %d MHz", radar->freq);
++	hostapd_dfs_sta_update_state(hapd->iface, radar->freq, radar->ht_enabled,
++				     radar->chan_offset, radar->chan_width,
++				     radar->cf1, radar->cf2, HOSTAPD_CHAN_DFS_USABLE);
++}
++
+ #endif /* NEED_AP_MLME */
+ 
+ 
+@@ -2064,6 +2082,16 @@ void hostapd_wpa_event(void *ctx, enum wpa_event_type event,
+ 			break;
+ 		hostapd_event_dfs_nop_finished(hapd, &data->dfs_event);
+ 		break;
++	case EVENT_DFS_STA_CAC_SKIPPED:
++		if (!data)
++			break;
++		hostapd_event_dfs_sta_cac_skipped(hapd, &data->dfs_event);
++		break;
++	case EVENT_DFS_STA_CAC_EXPIRED:
++		if (!data)
++			break;
++		hostapd_event_dfs_sta_cac_expired(hapd, &data->dfs_event);
++		break;
+ 	case EVENT_CHANNEL_LIST_CHANGED:
+ 		/* channel list changed (regulatory?), update channel list */
+ 		/* TODO: check this. hostapd_get_hw_features() initializes
+diff --git a/src/common/wpa_ctrl.h b/src/common/wpa_ctrl.h
+index 3435084..79c8a82 100644
+--- a/src/common/wpa_ctrl.h
++++ b/src/common/wpa_ctrl.h
+@@ -360,6 +360,7 @@ extern "C" {
+ #define DFS_EVENT_CAC_COMPLETED "DFS-CAC-COMPLETED "
+ #define DFS_EVENT_NOP_FINISHED "DFS-NOP-FINISHED "
+ #define DFS_EVENT_PRE_CAC_EXPIRED "DFS-PRE-CAC-EXPIRED "
++#define DFS_EVENT_STA_UPDATE "DFS-STA-UPDATE "
+ 
+ #define AP_CSA_FINISHED "AP-CSA-FINISHED "
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 265d86d..b5de0e6 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -5317,6 +5317,20 @@ enum wpa_event_type {
+ 	 * EVENT_CCA_NOTIFY - Notification that CCA has completed
+ 	 */
+ 	EVENT_CCA_NOTIFY,
++
++	/**
++	 * EVENT_DFS_STA_CAC_SKIPPED - Notification that CAC has been skipped
++	 *
++	 * The channel in the notification is now marked as available.
++	 */
++	EVENT_DFS_STA_CAC_SKIPPED,
++
++	/**
++	 * EVENT_DFS_STA_CAC_EXPIRED - Notification that CAC has expired
++	 *
++	 * The channel in the notification is now marked as usable.
++	 */
++	EVENT_DFS_STA_CAC_EXPIRED,
+ };
+ 
+ 
+diff --git a/src/drivers/driver_nl80211_event.c b/src/drivers/driver_nl80211_event.c
+index 73bb7a4..ee922ac 100644
+--- a/src/drivers/driver_nl80211_event.c
++++ b/src/drivers/driver_nl80211_event.c
+@@ -1854,6 +1854,12 @@ static void nl80211_radar_event(struct wpa_driver_nl80211_data *drv,
+ 	case NL80211_RADAR_CAC_STARTED:
+ 		wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_STARTED, &data);
+ 		break;
++	case NL80211_RADAR_STA_CAC_SKIPPED:
++		wpa_supplicant_event(drv->ctx, EVENT_DFS_STA_CAC_SKIPPED, &data);
++		break;
++	case NL80211_RADAR_STA_CAC_EXPIRED:
++		wpa_supplicant_event(drv->ctx, EVENT_DFS_STA_CAC_EXPIRED, &data);
++		break;
+ 	default:
+ 		wpa_printf(MSG_DEBUG, "nl80211: Unknown radar event %d "
+ 			   "received", event_type);
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index c4bf3ad..0937752 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -6431,6 +6431,10 @@ enum nl80211_smps_mode {
+  *	applicable for ETSI dfs domain where pre-CAC is valid for ever.
+  * @NL80211_RADAR_CAC_STARTED: Channel Availability Check has been started,
+  *	should be generated by HW if NL80211_EXT_FEATURE_DFS_OFFLOAD is enabled.
++ * @NL80211_RADAR_STA_CAC_SKIPPED: STA set the DFS state to available
++ *	when receiving CSA/assoc resp
++ * @NL80211_RADAR_STA_CAC_EXPIRED: STA set the DFS state to usable
++ *	when STA is disconnected or leaving the channel
+  */
+ enum nl80211_radar_event {
+ 	NL80211_RADAR_DETECTED,
+@@ -6439,6 +6443,8 @@ enum nl80211_radar_event {
+ 	NL80211_RADAR_NOP_FINISHED,
+ 	NL80211_RADAR_PRE_CAC_EXPIRED,
+ 	NL80211_RADAR_CAC_STARTED,
++	NL80211_RADAR_STA_CAC_SKIPPED,
++	NL80211_RADAR_STA_CAC_EXPIRED,
+ };
+ 
+ /**
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
new file mode 100644
index 0000000..8340fd9
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
@@ -0,0 +1,43 @@
+From 83ab1a9cc51225095842d3c62bf75cf4efe63075 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 16:58:20 +0800
+Subject: [PATCH] hostapd: mtk: Fix auto ht issue when switching to DFS channel
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 0ad8451..407790f 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -2698,6 +2698,12 @@ static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
+ 		break;
+ 	}
+ 
++	if (os_strstr(pos, " auto-ht")) {
++		settings.freq_params.ht_enabled = iface->conf->ieee80211n;
++		settings.freq_params.vht_enabled = iface->conf->ieee80211ac;
++		settings.freq_params.he_enabled = iface->conf->ieee80211ax;
++	}
++
+ 	if (settings.freq_params.center_freq1)
+ 		dfs_range += hostapd_is_dfs_overlap(
+ 			iface, bandwidth, settings.freq_params.center_freq1);
+@@ -2735,12 +2741,6 @@ static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
+ 		return 0;
+ 	}
+ 
+-	if (os_strstr(pos, " auto-ht")) {
+-		settings.freq_params.ht_enabled = iface->conf->ieee80211n;
+-		settings.freq_params.vht_enabled = iface->conf->ieee80211ac;
+-		settings.freq_params.he_enabled = iface->conf->ieee80211ax;
+-	}
+-
+ 	for (i = 0; i < iface->num_bss; i++) {
+ 
+ 		/* Save CHAN_SWITCH VHT, HE, and EHT config */
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc b/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
index 4a42f53..78d5240 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
@@ -71,11 +71,15 @@
     file://mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch \
     file://mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch \
     file://mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch \
-    file://mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch \
-    file://mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch \
-    file://mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch \
-    file://mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch \
-    file://mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch \
-    file://mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch \
+    file://mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch \
+    file://mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch \
+    file://mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch \
+    file://mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch \
+    file://mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch \
+    file://mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch \
+    file://mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch \
+    file://mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch \
+    file://mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch \
+    file://mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch \
     file://mtk-0100-hostapd-mtk-update-eht-operation-elem.patch \
     "
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch b/recipes-wifi/hostapd/files/patches/mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
deleted file mode 100644
index 3237aa3..0000000
--- a/recipes-wifi/hostapd/files/patches/mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
+++ /dev/null
@@ -1,376 +0,0 @@
-From 4e7c861c971ca49ea162bd908fef6021a62b9018 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Fri, 7 Oct 2022 10:46:29 +0800
-Subject: [PATCH 10/15] hostapd: mtk: Add DFS and ZWDFS support
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- hostapd/config_file.c        |  4 ++
- hostapd/ctrl_iface.c         | 95 ++++++++++++++++++++++++++++++++++++
- src/ap/ap_config.h           | 13 +++++
- src/ap/dfs.c                 | 35 +++++++------
- src/ap/dfs.h                 | 15 ++++++
- src/ap/hostapd.c             |  4 +-
- src/drivers/driver.h         |  7 +++
- src/drivers/driver_nl80211.c | 29 +++++++++++
- src/drivers/nl80211_copy.h   |  1 +
- 9 files changed, 186 insertions(+), 17 deletions(-)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 63c9d40be..cd1534952 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -4803,6 +4803,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
- 		int val = atoi(pos);
- 		conf->ibf_enable = !!val;
-+	} else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
-+		u8 en = strtol(pos, NULL, 10);
-+
-+		conf->dfs_detect_mode = en;
- 	} else {
- 		wpa_printf(MSG_ERROR,
- 			   "Line %d: unknown configuration item '%s'",
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index c881d3717..6ea1573b8 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -3522,6 +3522,96 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
- }
- 
- 
-+static int
-+hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
-+				       char *buf, size_t buflen)
-+{
-+	u8 dfs_detect_mode;
-+
-+	if (!value)
-+		return -1;
-+
-+	dfs_detect_mode = strtol(value, NULL, 10);
-+	if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
-+		wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
-+		return -1;
-+	}
-+	hapd->iconf->dfs_detect_mode = dfs_detect_mode;
-+
-+	return os_snprintf(buf, buflen, "OK\n");
-+}
-+
-+
-+static int
-+hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
-+				    char *buf, size_t buflen)
-+{
-+	struct hostapd_iface *iface = hapd->iface;
-+	char *pos, *param;
-+	enum hostapd_hw_mode hw_mode;
-+	bool chan_found = false;
-+	int i, num_available_chandefs, channel, chan_width, sec = 0;
-+	int sec_chan_idx_80p80 = -1;
-+	u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
-+	struct hostapd_channel_data *chan;
-+	enum dfs_channel_type type = DFS_NO_CAC_YET;
-+
-+	param = os_strchr(cmd, ' ');
-+	if (!param)
-+		return -1;
-+	*param++ = '\0';
-+
-+	pos = os_strstr(param, "chan=");
-+	if (pos)
-+		channel = strtol(pos + 5, NULL, 10);
-+	else
-+		return -1;
-+
-+	num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
-+	for (i = 0; i < num_available_chandefs; i++) {
-+		dfs_find_channel(iface, &chan, i, type);
-+		if (chan->chan == channel) {
-+			chan_found = true;
-+			break;
-+		}
-+	}
-+
-+	if (!chan_found)
-+		return -1;
-+
-+	if (iface->conf->secondary_channel)
-+		sec = 1;
-+
-+	dfs_adjust_center_freq(iface, chan,
-+			       sec,
-+			       sec_chan_idx_80p80,
-+			       &oper_centr_freq_seg0_idx,
-+			       &oper_centr_freq_seg1_idx);
-+
-+	if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
-+				  chan->freq, chan->chan,
-+				  iface->conf->ieee80211n,
-+				  iface->conf->ieee80211ac,
-+				  iface->conf->ieee80211ax,
-+				  iface->conf->ieee80211be,
-+				  sec, hostapd_get_oper_chwidth(iface->conf),
-+				  oper_centr_freq_seg0_idx,
-+				  oper_centr_freq_seg1_idx, true)) {
-+		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
-+		iface->radar_background.channel = -1;
-+		return -1;
-+	}
-+
-+	iface->radar_background.channel = chan->chan;
-+	iface->radar_background.freq = chan->freq;
-+	iface->radar_background.secondary_channel = sec;
-+	iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
-+	iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
-+
-+	return os_snprintf(buf, buflen, "OK\n");
-+}
-+
-+
- static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 					      char *buf, char *reply,
- 					      int reply_size,
-@@ -4081,6 +4171,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 		reply_len = hostapd_ctrl_iface_get_mu(hapd, reply, reply_size);
- 	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
- 		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
-+	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
-+		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
-+								   reply, reply_size);
-+	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
-+		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
- 	} else {
- 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
- 		reply_len = 16;
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9e3d2aeb..77f6169d2 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -1160,6 +1160,7 @@ struct hostapd_config {
- 	int *edcca_threshold;
- 	u8 three_wire_enable;
- 	u8 ibf_enable;
-+	u8 dfs_detect_mode;
- };
- 
- enum three_wire_mode {
-@@ -1174,6 +1175,18 @@ enum three_wire_mode {
- 		NUM_THREE_WIRE_MODE - 1
- };
- 
-+enum dfs_mode {
-+	DFS_DETECT_MODE_DISABLE,
-+	DFS_DETECT_MODE_AP_ENABLE,
-+	DFS_DETECT_MODE_BACKGROUND_ENABLE,
-+	DFS_DETECT_MODE_ALL_ENABLE,
-+
-+	/* keep last */
-+	NUM_DFS_DETECT_MODE,
-+	DFS_DETECT_MODE_MAX =
-+		NUM_DFS_DETECT_MODE - 1
-+};
-+
- enum edcca_mode {
- 	EDCCA_MODE_FORCE_DISABLE = 0,
- 	EDCCA_MODE_AUTO = 1,
-diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index b5d105d6a..1c3f6785b 100644
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -19,13 +19,6 @@
- #include "dfs.h"
- #include "crypto/crypto.h"
- 
--
--enum dfs_channel_type {
--	DFS_ANY_CHANNEL,
--	DFS_AVAILABLE, /* non-radar or radar-available */
--	DFS_NO_CAC_YET, /* radar-not-yet-available */
--};
--
- static struct hostapd_channel_data *
- dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
- 			u8 *oper_centr_freq_seg0_idx,
-@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
-  *  - hapd->vht/he_oper_centr_freq_seg0_idx
-  *  - hapd->vht/he_oper_centr_freq_seg1_idx
-  */
--static int dfs_find_channel(struct hostapd_iface *iface,
--			    struct hostapd_channel_data **ret_chan,
--			    int idx, enum dfs_channel_type type)
-+int dfs_find_channel(struct hostapd_iface *iface,
-+		     struct hostapd_channel_data **ret_chan,
-+		     int idx, enum dfs_channel_type type)
- {
- 	struct hostapd_hw_modes *mode;
- 	struct hostapd_channel_data *chan;
-@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
- }
- 
- 
--static void dfs_adjust_center_freq(struct hostapd_iface *iface,
--				   struct hostapd_channel_data *chan,
--				   int secondary_channel,
--				   int sec_chan_idx_80p80,
--				   u8 *oper_centr_freq_seg0_idx,
--				   u8 *oper_centr_freq_seg1_idx)
-+void dfs_adjust_center_freq(struct hostapd_iface *iface,
-+			    struct hostapd_channel_data *chan,
-+			    int secondary_channel,
-+			    int sec_chan_idx_80p80,
-+			    u8 *oper_centr_freq_seg0_idx,
-+			    u8 *oper_centr_freq_seg1_idx)
- {
- 	if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
- 		return;
-@@ -1317,6 +1310,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
- 		   __func__, iface->radar_background.cac_started ? "yes" : "no",
- 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
- 
-+	/* Skip channel switch when background dfs detect mode is on */
-+	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
-+	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
-+		return 0;
-+
- 	/* Check if CSA in progress */
- 	if (hostapd_csa_in_progress(iface))
- 		return 0;
-@@ -1365,6 +1363,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
- 		   __func__, iface->cac_started ? "yes" : "no",
- 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
- 
-+	/* Skip channel switch when dfs detect mode is on */
-+	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
-+	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
-+		return 0;
-+
- 	/* Check if CSA in progress */
- 	if (hostapd_csa_in_progress(iface))
- 		return 0;
-diff --git a/src/ap/dfs.h b/src/ap/dfs.h
-index 606c1b393..c2556d2d9 100644
---- a/src/ap/dfs.h
-+++ b/src/ap/dfs.h
-@@ -9,6 +9,12 @@
- #ifndef DFS_H
- #define DFS_H
- 
-+enum dfs_channel_type {
-+	DFS_ANY_CHANNEL,
-+	DFS_AVAILABLE, /* non-radar or radar-available */
-+	DFS_NO_CAC_YET, /* radar-not-yet-available */
-+};
-+
- int hostapd_handle_dfs(struct hostapd_iface *iface);
- 
- int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
-@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
- int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
- int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
- 			   int center_freq);
-+int dfs_find_channel(struct hostapd_iface *iface,
-+		     struct hostapd_channel_data **ret_chan,
-+		     int idx, enum dfs_channel_type type);
-+void dfs_adjust_center_freq(struct hostapd_iface *iface,
-+			    struct hostapd_channel_data *chan,
-+			    int secondary_channel,
-+			    int sec_chan_idx_80p80,
-+			    u8 *oper_centr_freq_seg0_idx,
-+			    u8 *oper_centr_freq_seg1_idx);
- 
- #endif /* DFS_H */
-diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index da7f7d87b..a0229c9ca 100644
---- a/src/ap/hostapd.c
-+++ b/src/ap/hostapd.c
-@@ -1464,7 +1464,9 @@ static int hostapd_setup_bss(struct hostapd_data *hapd, int first)
- 		return -1;
- 	}
- 
--	if (!conf->start_disabled && ieee802_11_set_beacon(hapd) < 0)
-+	if (conf->start_disabled)
-+		hapd->driver->start_disabled(hapd->drv_priv);
-+	else if (ieee802_11_set_beacon(hapd) < 0)
- 		return -1;
- 
- 	if (flush_old_stations && !conf->start_disabled &&
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 71ded617f..aa23fbdb3 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -4720,6 +4720,13 @@ struct wpa_driver_ops {
- 	 *
- 	 */
- 	int (*ibf_dump)(void *priv, u8 *ibf_enable);
-+
-+	/**
-+	 * start_disabled - set start_disabled to cfg80211
-+	 * @priv: Private driver interface data
-+	 *
-+	 */
-+	int (*start_disabled)(void *priv);
- };
- 
- /**
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 5c2a291ca..7472542cc 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -12776,6 +12776,34 @@ fail:
- 	return -ENOBUFS;
- }
- 
-+static int nl80211_start_disabled(void *priv)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_NEW_BEACON);
-+	if (!msg)
-+		goto fail;
-+
-+	if (nla_put_flag(msg, NL80211_ATTR_START_DISABLED))
-+		goto fail;
-+
-+	ret = send_and_recv_msgs_connect_handle(drv, msg, bss, 1);
-+
-+	if (ret)
-+		wpa_printf(MSG_ERROR, "Failed to set start_disabled. ret=%d (%s)",
-+			   ret, strerror(-ret));
-+
-+	return ret;
-+
-+fail:
-+	nlmsg_free(msg);
-+	return ret;
-+}
-+
- const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.name = "nl80211",
- 	.desc = "Linux nl80211/cfg80211",
-@@ -12930,4 +12958,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.three_wire_ctrl = nl80211_enable_three_wire,
- 	.ibf_ctrl = nl80211_ibf_enable,
- 	.ibf_dump = nl80211_ibf_dump,
-+	.start_disabled = nl80211_start_disabled,
- };
-diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index c4bf3ad35..79bc76c57 100644
---- a/src/drivers/nl80211_copy.h
-+++ b/src/drivers/nl80211_copy.h
-@@ -3176,6 +3176,7 @@ enum nl80211_attrs {
- 	NL80211_ATTR_EHT_CAPABILITY,
- 
- 	/* add attributes here, update the policy in nl80211.c */
-+	NL80211_ATTR_START_DISABLED = 999,
- 
- 	__NL80211_ATTR_AFTER_LAST,
- 	NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch b/recipes-wifi/hostapd/files/patches/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
new file mode 100644
index 0000000..2ceb639
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
@@ -0,0 +1,136 @@
+From 6828156c206701f5a0e5d30afcc514f452ce0ada Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 14:55:49 +0800
+Subject: [PATCH 10/16] hostapd: mtk: Add DFS detection mode
+
+Add DFS detection mode for testing radar detection rate.
+If DFS detection mode is on, AP will not switch channels when receiving
+a radar signal.
+This detection mode also supports background chain.
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c |  4 ++++
+ hostapd/ctrl_iface.c  | 23 +++++++++++++++++++++++
+ src/ap/ap_config.h    | 13 +++++++++++++
+ src/ap/dfs.c          | 10 ++++++++++
+ 4 files changed, 50 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 63c9d40..cd15349 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4803,6 +4803,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
+ 		int val = atoi(pos);
+ 		conf->ibf_enable = !!val;
++	} else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
++		u8 en = strtol(pos, NULL, 10);
++
++		conf->dfs_detect_mode = en;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c881d37..0b4c234 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3522,6 +3522,26 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
++				       char *buf, size_t buflen)
++{
++	u8 dfs_detect_mode;
++
++	if (!value)
++		return -1;
++
++	dfs_detect_mode = strtol(value, NULL, 10);
++	if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
++		wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
++		return -1;
++	}
++	hapd->iconf->dfs_detect_mode = dfs_detect_mode;
++
++	return os_snprintf(buf, buflen, "OK\n");
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4081,6 +4101,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ 	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
+ 		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
++	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
++		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
++								   reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index a9e3d2a..77f6169 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1160,6 +1160,7 @@ struct hostapd_config {
+ 	int *edcca_threshold;
+ 	u8 three_wire_enable;
+ 	u8 ibf_enable;
++	u8 dfs_detect_mode;
+ };
+ 
+ enum three_wire_mode {
+@@ -1174,6 +1175,18 @@ enum three_wire_mode {
+ 		NUM_THREE_WIRE_MODE - 1
+ };
+ 
++enum dfs_mode {
++	DFS_DETECT_MODE_DISABLE,
++	DFS_DETECT_MODE_AP_ENABLE,
++	DFS_DETECT_MODE_BACKGROUND_ENABLE,
++	DFS_DETECT_MODE_ALL_ENABLE,
++
++	/* keep last */
++	NUM_DFS_DETECT_MODE,
++	DFS_DETECT_MODE_MAX =
++		NUM_DFS_DETECT_MODE - 1
++};
++
+ enum edcca_mode {
+ 	EDCCA_MODE_FORCE_DISABLE = 0,
+ 	EDCCA_MODE_AUTO = 1,
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index b5d105d..5cb7799 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1317,6 +1317,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ 		   __func__, iface->radar_background.cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when background dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+@@ -1365,6 +1370,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
+ 		   __func__, iface->cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch b/recipes-wifi/hostapd/files/patches/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
new file mode 100644
index 0000000..1d8baf8
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
@@ -0,0 +1,192 @@
+From 88dd3df28e3736af4cca0daf4f7d19ab888ea6c4 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 14:56:55 +0800
+Subject: [PATCH 11/16] hostapd: mtk: Add DFS offchan channel switch
+
+Add DFS background chain channel switch command for testing purpose.
+This feature is implemented via hostapd_cli command.
+Command format:
+hostapd_cli -i <interface> raw SET_OFFCHAN_CTRL chan=<dfs_channel>
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 72 ++++++++++++++++++++++++++++++++++++++++++++
+ src/ap/dfs.c         | 25 ++++++---------
+ src/ap/dfs.h         | 15 +++++++++
+ 3 files changed, 96 insertions(+), 16 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 0b4c234..6ea1573 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3542,6 +3542,76 @@ hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
++				    char *buf, size_t buflen)
++{
++	struct hostapd_iface *iface = hapd->iface;
++	char *pos, *param;
++	enum hostapd_hw_mode hw_mode;
++	bool chan_found = false;
++	int i, num_available_chandefs, channel, chan_width, sec = 0;
++	int sec_chan_idx_80p80 = -1;
++	u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
++	struct hostapd_channel_data *chan;
++	enum dfs_channel_type type = DFS_NO_CAC_YET;
++
++	param = os_strchr(cmd, ' ');
++	if (!param)
++		return -1;
++	*param++ = '\0';
++
++	pos = os_strstr(param, "chan=");
++	if (pos)
++		channel = strtol(pos + 5, NULL, 10);
++	else
++		return -1;
++
++	num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
++	for (i = 0; i < num_available_chandefs; i++) {
++		dfs_find_channel(iface, &chan, i, type);
++		if (chan->chan == channel) {
++			chan_found = true;
++			break;
++		}
++	}
++
++	if (!chan_found)
++		return -1;
++
++	if (iface->conf->secondary_channel)
++		sec = 1;
++
++	dfs_adjust_center_freq(iface, chan,
++			       sec,
++			       sec_chan_idx_80p80,
++			       &oper_centr_freq_seg0_idx,
++			       &oper_centr_freq_seg1_idx);
++
++	if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
++				  chan->freq, chan->chan,
++				  iface->conf->ieee80211n,
++				  iface->conf->ieee80211ac,
++				  iface->conf->ieee80211ax,
++				  iface->conf->ieee80211be,
++				  sec, hostapd_get_oper_chwidth(iface->conf),
++				  oper_centr_freq_seg0_idx,
++				  oper_centr_freq_seg1_idx, true)) {
++		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
++		iface->radar_background.channel = -1;
++		return -1;
++	}
++
++	iface->radar_background.channel = chan->chan;
++	iface->radar_background.freq = chan->freq;
++	iface->radar_background.secondary_channel = sec;
++	iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
++	iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
++
++	return os_snprintf(buf, buflen, "OK\n");
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4104,6 +4174,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
+ 		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
+ 								   reply, reply_size);
++	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
++		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 5cb7799..1c3f678 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -19,13 +19,6 @@
+ #include "dfs.h"
+ #include "crypto/crypto.h"
+ 
+-
+-enum dfs_channel_type {
+-	DFS_ANY_CHANNEL,
+-	DFS_AVAILABLE, /* non-radar or radar-available */
+-	DFS_NO_CAC_YET, /* radar-not-yet-available */
+-};
+-
+ static struct hostapd_channel_data *
+ dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
+ 			u8 *oper_centr_freq_seg0_idx,
+@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
+  *  - hapd->vht/he_oper_centr_freq_seg0_idx
+  *  - hapd->vht/he_oper_centr_freq_seg1_idx
+  */
+-static int dfs_find_channel(struct hostapd_iface *iface,
+-			    struct hostapd_channel_data **ret_chan,
+-			    int idx, enum dfs_channel_type type)
++int dfs_find_channel(struct hostapd_iface *iface,
++		     struct hostapd_channel_data **ret_chan,
++		     int idx, enum dfs_channel_type type)
+ {
+ 	struct hostapd_hw_modes *mode;
+ 	struct hostapd_channel_data *chan;
+@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
+ }
+ 
+ 
+-static void dfs_adjust_center_freq(struct hostapd_iface *iface,
+-				   struct hostapd_channel_data *chan,
+-				   int secondary_channel,
+-				   int sec_chan_idx_80p80,
+-				   u8 *oper_centr_freq_seg0_idx,
+-				   u8 *oper_centr_freq_seg1_idx)
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++			    struct hostapd_channel_data *chan,
++			    int secondary_channel,
++			    int sec_chan_idx_80p80,
++			    u8 *oper_centr_freq_seg0_idx,
++			    u8 *oper_centr_freq_seg1_idx)
+ {
+ 	if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
+ 		return;
+diff --git a/src/ap/dfs.h b/src/ap/dfs.h
+index 606c1b3..c2556d2 100644
+--- a/src/ap/dfs.h
++++ b/src/ap/dfs.h
+@@ -9,6 +9,12 @@
+ #ifndef DFS_H
+ #define DFS_H
+ 
++enum dfs_channel_type {
++	DFS_ANY_CHANNEL,
++	DFS_AVAILABLE, /* non-radar or radar-available */
++	DFS_NO_CAC_YET, /* radar-not-yet-available */
++};
++
+ int hostapd_handle_dfs(struct hostapd_iface *iface);
+ 
+ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+ int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
+ int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
+ 			   int center_freq);
++int dfs_find_channel(struct hostapd_iface *iface,
++		     struct hostapd_channel_data **ret_chan,
++		     int idx, enum dfs_channel_type type);
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++			    struct hostapd_channel_data *chan,
++			    int secondary_channel,
++			    int sec_chan_idx_80p80,
++			    u8 *oper_centr_freq_seg0_idx,
++			    u8 *oper_centr_freq_seg1_idx);
+ 
+ #endif /* DFS_H */
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch b/recipes-wifi/hostapd/files/patches/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
deleted file mode 100644
index dba90d1..0000000
--- a/recipes-wifi/hostapd/files/patches/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
+++ /dev/null
@@ -1,400 +0,0 @@
-From bc0722ebc1cc08be6239879fddaef37e0db2d9e0 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Fri, 16 Dec 2022 03:57:11 +0800
-Subject: [PATCH 11/15] hostapd: mtk: Add amsdu set get ctrl
-
----
- hostapd/config_file.c             |   9 +++
- hostapd/ctrl_iface.c              |  26 +++++++
- hostapd/hostapd_cli.c             |   9 +++
- src/ap/ap_config.c                |   1 +
- src/ap/ap_config.h                |   1 +
- src/ap/ap_drv_ops.c               |  14 ++++
- src/ap/ap_drv_ops.h               |   2 +
- src/ap/hostapd.c                  |   2 +
- src/common/mtk_vendor.h           |  17 ++++-
- src/drivers/driver.h              |   9 +++
- src/drivers/driver_nl80211.c      | 114 ++++++++++++++++++++++++++++++
- src/drivers/driver_nl80211.h      |   1 +
- src/drivers/driver_nl80211_capa.c |   3 +
- 13 files changed, 207 insertions(+), 1 deletion(-)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd1534952..10ea52518 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -4807,6 +4807,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 		u8 en = strtol(pos, NULL, 10);
- 
- 		conf->dfs_detect_mode = en;
-+	} else if (os_strcmp(buf, "amsdu") == 0) {
-+		int val = atoi(pos);
-+		if (val < 0 || val > 1) {
-+			wpa_printf(MSG_ERROR,
-+					 "Line %d: invalid amsdu value",
-+					 line);
-+			return 1;
-+		}
-+		conf->amsdu = val;
- 	} else {
- 		wpa_printf(MSG_ERROR,
- 			   "Line %d: unknown configuration item '%s'",
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 6ea1573b8..0ad8451aa 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -3612,6 +3612,30 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
- }
- 
- 
-+static int
-+hostapd_ctrl_iface_get_amsdu(struct hostapd_data *hapd, char *buf,
-+					 size_t buflen)
-+{
-+	u8 amsdu;
-+	int ret;
-+	char *pos, *end;
-+
-+	pos = buf;
-+	end = buf + buflen;
-+
-+	if (hostapd_drv_amsdu_dump(hapd, &amsdu) == 0) {
-+		hapd->iconf->amsdu = amsdu;
-+		ret = os_snprintf(pos, end - pos, "[hostapd_cli] AMSDU: %u\n",
-+					hapd->iconf->amsdu);
-+	}
-+
-+	if (os_snprintf_error(end - pos, ret))
-+		return 0;
-+
-+	return ret;
-+}
-+
-+
- static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 					      char *buf, char *reply,
- 					      int reply_size,
-@@ -4176,6 +4200,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 								   reply, reply_size);
- 	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
- 		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
-+	} else if (os_strncmp(buf, "GET_AMSDU", 9) == 0) {
-+		reply_len = hostapd_ctrl_iface_get_amsdu(hapd, reply, reply_size);
- 	} else {
- 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
- 		reply_len = 16;
-diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index c2a123a8c..30b3392e6 100644
---- a/hostapd/hostapd_cli.c
-+++ b/hostapd/hostapd_cli.c
-@@ -1593,6 +1593,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
- }
- 
- 
-+static int hostapd_cli_cmd_get_amsdu(struct wpa_ctrl *ctrl, int argc,
-+					   char *argv[])
-+{
-+	return hostapd_cli_cmd(ctrl, "GET_AMSDU", 0, NULL, NULL);
-+}
-+
-+
- struct hostapd_cli_cmd {
- 	const char *cmd;
- 	int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
-@@ -1796,6 +1803,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
-           "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
- 	{ "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
- 	  " = show iBF state (enabled/disabled)"},
-+	{ "get_amsdu", hostapd_cli_cmd_get_amsdu, NULL,
-+		" = show AMSDU state"},
- 	{ NULL, NULL, NULL, NULL }
- };
- 
-diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 7a96cb8b2..85ad5e444 100644
---- a/src/ap/ap_config.c
-+++ b/src/ap/ap_config.c
-@@ -299,6 +299,7 @@ struct hostapd_config * hostapd_config_defaults(void)
- 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
- 	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
- 	conf->ibf_enable = IBF_DEFAULT_ENABLE;
-+	conf->amsdu = 1;
- 
- 	return conf;
- }
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 77f6169d2..a9ac39619 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -1161,6 +1161,7 @@ struct hostapd_config {
- 	u8 three_wire_enable;
- 	u8 ibf_enable;
- 	u8 dfs_detect_mode;
-+	u8 amsdu;
- };
- 
- enum three_wire_mode {
-diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 60ae8253b..1a82f234c 100644
---- a/src/ap/ap_drv_ops.c
-+++ b/src/ap/ap_drv_ops.c
-@@ -1077,4 +1077,18 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
- 	if (!hapd->driver || !hapd->driver->ibf_dump)
- 		return 0;
- 	return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
-+}
-+
-+int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd)
-+{
-+	if (!hapd->driver || !hapd->driver->amsdu_ctrl)
-+		return 0;
-+	return hapd->driver->amsdu_ctrl(hapd->drv_priv, hapd->iconf->amsdu);
-+}
-+
-+int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu)
-+{
-+	if (!hapd->driver || !hapd->driver->amsdu_dump)
-+		return 0;
-+	return hapd->driver->amsdu_dump(hapd->drv_priv, amsdu);
- }
-\ No newline at end of file
-diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index ab9aedcee..4406666fd 100644
---- a/src/ap/ap_drv_ops.h
-+++ b/src/ap/ap_drv_ops.h
-@@ -147,6 +147,8 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff);
- int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
- int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
- int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
-+int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd);
-+int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu);
- 
- #include "drivers/driver.h"
- 
-diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index a0229c9ca..152060db4 100644
---- a/src/ap/hostapd.c
-+++ b/src/ap/hostapd.c
-@@ -2310,6 +2310,8 @@ dfs_offload:
- 		goto fail;
- 	if (hostapd_drv_ibf_ctrl(hapd) < 0)
- 		goto fail;
-+	if (hostapd_drv_amsdu_ctrl(hapd) < 0)
-+		goto fail;
- 
- 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
- 		   iface->bss[0]->conf->iface);
-diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 4050cf886..0999ea9e2 100644
---- a/src/common/mtk_vendor.h
-+++ b/src/common/mtk_vendor.h
-@@ -167,7 +167,6 @@ enum mtk_vendor_attr_wireless_ctrl {
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
--	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
- 
-@@ -177,6 +176,22 @@ enum mtk_vendor_attr_wireless_ctrl {
- 		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
- };
- 
-+enum mtk_vendor_attr_wireless_dump {
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP,
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX =
-+		NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP - 1
-+};
-+
-+static const struct nla_policy
-+wireless_dump_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP] = {
-+	[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU] = { .type = NLA_U8 },
-+};
-+
- enum mtk_vendor_attr_rfeature_ctrl {
- 	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
- 
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index aa23fbdb3..b07aaf3fe 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -4727,6 +4727,15 @@ struct wpa_driver_ops {
- 	 *
- 	 */
- 	int (*start_disabled)(void *priv);
-+
-+	/**
-+	 * amsdu_ctrl - enable/disable amsdu
-+	 * amsdu_dump - get current amsdu status
-+	 * @priv: Private driver interface data
-+	 *
-+	 */
-+	int (*amsdu_ctrl)(void *priv, u8 amsdu);
-+	int (*amsdu_dump)(void *priv, u8 *amsdu);
- };
- 
- /**
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 7472542cc..6702384ef 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -12804,6 +12804,118 @@ fail:
- 	return ret;
- }
- 
-+static int nl80211_enable_amsdu(void *priv, u8 amsdu)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	if (!drv->mtk_wireless_vendor_cmd_avail) {
-+		wpa_printf(MSG_INFO,
-+			   "nl80211: Driver does not support setting ap wireless control");
-+		return 0;
-+	}
-+
-+	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
-+	if (!msg)
-+		goto fail;
-+
-+	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
-+		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
-+		goto fail;
-+
-+	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
-+	if (!data)
-+		goto fail;
-+
-+	nla_put_u8(msg, MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU, amsdu);
-+
-+	nla_nest_end(msg, data);
-+	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
-+	if (ret) {
-+		wpa_printf(MSG_ERROR, "Failed to set amsdu. ret=%d (%s)", ret, strerror(-ret));
-+	}
-+
-+	return ret;
-+
-+fail:
-+	nlmsg_free(msg);
-+	return -ENOBUFS;
-+}
-+
-+static int dump_amsdu_handler(struct nl_msg *msg, void *arg)
-+{
-+	u8 *amsdu = (u8 *) arg;
-+	struct nlattr *tb[NL80211_ATTR_MAX + 1];
-+	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX + 1];
-+	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
-+	struct nlattr *nl_vend, *attr_amsdu;
-+
-+	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
-+			genlmsg_attrlen(gnlh, 0), NULL);
-+
-+	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
-+	if (!nl_vend)
-+		return NL_SKIP;
-+
-+	nla_parse(tb_vendor, MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX,
-+			nla_data(nl_vend), nla_len(nl_vend), NULL);
-+
-+	attr_amsdu = tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU];
-+	if (!attr_amsdu ){
-+		wpa_printf(MSG_ERROR, "nl80211: cannot find vendor attributes");
-+		return NL_SKIP;
-+	}
-+
-+	*amsdu = nla_get_u8(attr_amsdu);
-+
-+	return NL_SKIP;
-+}
-+
-+static int
-+nl80211_dump_amsdu(void *priv, u8 *amsdu)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	if (!drv->mtk_wireless_vendor_cmd_avail) {
-+		wpa_printf(MSG_INFO,
-+				 "nl80211: Driver does not support ap_wireless control");
-+		return 0;
-+	}
-+
-+	msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
-+	if (!msg)
-+		goto fail;
-+
-+	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
-+		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
-+		goto fail;
-+
-+	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
-+	if (!data)
-+		goto fail;
-+
-+	nla_nest_end(msg, data);
-+
-+	ret = send_and_recv_msgs(drv, msg, dump_amsdu_handler, amsdu, NULL, NULL);
-+
-+	if (ret) {
-+		wpa_printf(MSG_ERROR, "Failed to dump amsdu. ret=%d (%s)", ret, strerror(-ret));
-+	}
-+
-+	return ret;
-+
-+fail:
-+	nlmsg_free(msg);
-+	return -ENOBUFS;
-+}
-+
- const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.name = "nl80211",
- 	.desc = "Linux nl80211/cfg80211",
-@@ -12959,4 +13071,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.ibf_ctrl = nl80211_ibf_enable,
- 	.ibf_dump = nl80211_ibf_dump,
- 	.start_disabled = nl80211_start_disabled,
-+	.amsdu_ctrl = nl80211_enable_amsdu,
-+	.amsdu_dump = nl80211_dump_amsdu,
- };
-diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 607592ceb..e57022409 100644
---- a/src/drivers/driver_nl80211.h
-+++ b/src/drivers/driver_nl80211.h
-@@ -185,6 +185,7 @@ struct wpa_driver_nl80211_data {
- 	unsigned int mtk_mu_vendor_cmd_avail:1;
- 	unsigned int mtk_3wire_vendor_cmd_avail:1;
- 	unsigned int mtk_ibf_vendor_cmd_avail:1;
-+	unsigned int mtk_wireless_vendor_cmd_avail:1;
- 
- 	u64 vendor_scan_cookie;
- 	u64 remain_on_chan_cookie;
-diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 9ecc0ff9a..fcfa68bf7 100644
---- a/src/drivers/driver_nl80211_capa.c
-+++ b/src/drivers/driver_nl80211_capa.c
-@@ -1065,6 +1065,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
- 				case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
- 					drv->mtk_ibf_vendor_cmd_avail = 1;
- 					break;
-+				case MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL:
-+					drv->mtk_wireless_vendor_cmd_avail = 1;
-+					break;
- 				}
- 			}
- 
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch b/recipes-wifi/hostapd/files/patches/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
similarity index 92%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
copy to recipes-wifi/hostapd/files/patches/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
index dba90d1..7db3ae2 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
@@ -1,7 +1,7 @@
-From bc0722ebc1cc08be6239879fddaef37e0db2d9e0 Mon Sep 17 00:00:00 2001
+From d0128fc60d38ce4f20f8368bdc5ea9ed19a329b7 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 16 Dec 2022 03:57:11 +0800
-Subject: [PATCH 11/15] hostapd: mtk: Add amsdu set get ctrl
+Subject: [PATCH 12/16] hostapd: mtk: Add amsdu set get ctrl
 
 ---
  hostapd/config_file.c             |   9 +++
@@ -20,7 +20,7 @@
  13 files changed, 207 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd1534952..10ea52518 100644
+index cd15349..10ea525 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4807,6 +4807,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -40,7 +40,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 6ea1573b8..0ad8451aa 100644
+index 6ea1573..0ad8451 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3612,6 +3612,30 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
@@ -84,7 +84,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index c2a123a8c..30b3392e6 100644
+index c2a123a..30b3392 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1593,6 +1593,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
@@ -111,7 +111,7 @@
  };
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 7a96cb8b2..85ad5e444 100644
+index 7a96cb8..85ad5e4 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -299,6 +299,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -123,7 +123,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 77f6169d2..a9ac39619 100644
+index 77f6169..a9ac396 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1161,6 +1161,7 @@ struct hostapd_config {
@@ -135,7 +135,7 @@
  
  enum three_wire_mode {
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 60ae8253b..1a82f234c 100644
+index 60ae825..1a82f23 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1077,4 +1077,18 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
@@ -159,7 +159,7 @@
  }
 \ No newline at end of file
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index ab9aedcee..4406666fd 100644
+index ab9aedc..4406666 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -147,6 +147,8 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff);
@@ -172,10 +172,10 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index a0229c9ca..152060db4 100644
+index da7f7d8..a18e744 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -2310,6 +2310,8 @@ dfs_offload:
+@@ -2308,6 +2308,8 @@ dfs_offload:
  		goto fail;
  	if (hostapd_drv_ibf_ctrl(hapd) < 0)
  		goto fail;
@@ -185,7 +185,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 4050cf886..0999ea9e2 100644
+index 4050cf8..0999ea9 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -167,7 +167,6 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -220,13 +220,13 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index aa23fbdb3..b07aaf3fe 100644
+index 71ded61..265d86d 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -4727,6 +4727,15 @@ struct wpa_driver_ops {
+@@ -4720,6 +4720,15 @@ struct wpa_driver_ops {
  	 *
  	 */
- 	int (*start_disabled)(void *priv);
+ 	int (*ibf_dump)(void *priv, u8 *ibf_enable);
 +
 +	/**
 +	 * amsdu_ctrl - enable/disable amsdu
@@ -240,11 +240,11 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 7472542cc..6702384ef 100644
+index 5c2a291..d91b29c 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -12804,6 +12804,118 @@ fail:
- 	return ret;
+@@ -12776,6 +12776,118 @@ fail:
+ 	return -ENOBUFS;
  }
  
 +static int nl80211_enable_amsdu(void *priv, u8 amsdu)
@@ -362,15 +362,15 @@
  const struct wpa_driver_ops wpa_driver_nl80211_ops = {
  	.name = "nl80211",
  	.desc = "Linux nl80211/cfg80211",
-@@ -12959,4 +13071,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+@@ -12930,4 +13042,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.three_wire_ctrl = nl80211_enable_three_wire,
  	.ibf_ctrl = nl80211_ibf_enable,
  	.ibf_dump = nl80211_ibf_dump,
- 	.start_disabled = nl80211_start_disabled,
 +	.amsdu_ctrl = nl80211_enable_amsdu,
 +	.amsdu_dump = nl80211_dump_amsdu,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 607592ceb..e57022409 100644
+index 607592c..e570224 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -185,6 +185,7 @@ struct wpa_driver_nl80211_data {
@@ -382,7 +382,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 9ecc0ff9a..fcfa68bf7 100644
+index 9ecc0ff..fcfa68b 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1065,6 +1065,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -396,5 +396,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch b/recipes-wifi/hostapd/files/patches/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch
deleted file mode 100644
index 63101e0..0000000
--- a/recipes-wifi/hostapd/files/patches/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From b49ce922afa13fe8ea5d847753dfb7641b70c9a4 Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Thu, 12 Jan 2023 15:18:19 +0800
-Subject: [PATCH 12/15] hostapd: mtk: Add he_ldpc configuration
-
----
- hostapd/config_file.c        | 2 ++
- hostapd/hostapd.conf         | 5 +++++
- src/ap/ap_config.c           | 1 +
- src/ap/ap_config.h           | 1 +
- src/ap/ieee802_11_he.c       | 7 +++++++
- src/common/ieee802_11_defs.h | 3 +++
- 6 files changed, 19 insertions(+)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 10ea52518..4237a5cca 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -3508,6 +3508,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 		conf->he_phy_capab.he_su_beamformee = atoi(pos);
- 	} else if (os_strcmp(buf, "he_mu_beamformer") == 0) {
- 		conf->he_phy_capab.he_mu_beamformer = atoi(pos);
-+	} else if (os_strcmp(buf, "he_ldpc") == 0) {
-+		conf->he_phy_capab.he_ldpc = atoi(pos);
- 	} else if (os_strcmp(buf, "he_bss_color") == 0) {
- 		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
- 		conf->he_op.he_bss_color_disabled = 0;
-diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
-index ea67aa100..e3a5eb365 100644
---- a/hostapd/hostapd.conf
-+++ b/hostapd/hostapd.conf
-@@ -830,6 +830,11 @@ wmm_ac_vo_acm=0
- # 1 = supported
- #he_mu_beamformer=1
- 
-+#he_ldpc: HE LDPC support
-+# 0 = not supported
-+# 1 = supported (default)
-+#he_ldpc=1
-+
- # he_bss_color: BSS color (1-63)
- #he_bss_color=1
- 
-diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 85ad5e444..b283de624 100644
---- a/src/ap/ap_config.c
-+++ b/src/ap/ap_config.c
-@@ -268,6 +268,7 @@ struct hostapd_config * hostapd_config_defaults(void)
- #endif /* CONFIG_ACS */
- 
- #ifdef CONFIG_IEEE80211AX
-+	conf->he_phy_capab.he_ldpc = 1;
- 	conf->he_op.he_rts_threshold = HE_OPERATION_RTS_THRESHOLD_MASK >>
- 		HE_OPERATION_RTS_THRESHOLD_OFFSET;
- 	/* Set default basic MCS/NSS set to single stream MCS 0-7 */
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9ac39619..b8b20a7aa 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -929,6 +929,7 @@ struct hostapd_bss_config {
-  * struct he_phy_capabilities_info - HE PHY capabilities
-  */
- struct he_phy_capabilities_info {
-+	bool he_ldpc;
- 	bool he_su_beamformer;
- 	bool he_su_beamformee;
- 	bool he_mu_beamformer;
-diff --git a/src/ap/ieee802_11_he.c b/src/ap/ieee802_11_he.c
-index b5b7e5d46..f27aeb196 100644
---- a/src/ap/ieee802_11_he.c
-+++ b/src/ap/ieee802_11_he.c
-@@ -138,6 +138,13 @@ u8 * hostapd_eid_he_capab(struct hostapd_data *hapd, u8 *eid,
- 		os_memcpy(&cap->optional[mcs_nss_size],
- 			  mode->he_capab[opmode].ppet,  ppet_size);
- 
-+	if (hapd->iface->conf->he_phy_capab.he_ldpc)
-+		cap->he_phy_capab_info[HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX] |=
-+			HE_PHYCAP_LDPC_CODING_IN_PAYLOAD;
-+	else
-+		cap->he_phy_capab_info[HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX] &=
-+			~HE_PHYCAP_LDPC_CODING_IN_PAYLOAD;
-+
- 	if (hapd->iface->conf->he_phy_capab.he_su_beamformer)
- 		cap->he_phy_capab_info[HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX] |=
- 			HE_PHYCAP_SU_BEAMFORMER_CAPAB;
-diff --git a/src/common/ieee802_11_defs.h b/src/common/ieee802_11_defs.h
-index 65e125e83..62088bda6 100644
---- a/src/common/ieee802_11_defs.h
-+++ b/src/common/ieee802_11_defs.h
-@@ -2298,6 +2298,9 @@ struct ieee80211_spatial_reuse {
- #define HE_PHYCAP_CHANNEL_WIDTH_SET_160MHZ_IN_5G	((u8) BIT(3))
- #define HE_PHYCAP_CHANNEL_WIDTH_SET_80PLUS80MHZ_IN_5G	((u8) BIT(4))
- 
-+#define HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX	1
-+#define HE_PHYCAP_LDPC_CODING_IN_PAYLOAD	((u8) BIT(5))
-+
- #define HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX	3
- #define HE_PHYCAP_SU_BEAMFORMER_CAPAB		((u8) BIT(7))
- #define HE_PHYCAP_SU_BEAMFORMEE_CAPAB_IDX	4
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch b/recipes-wifi/hostapd/files/patches/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
similarity index 90%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch
copy to recipes-wifi/hostapd/files/patches/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
index 63101e0..4df0ba6 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
@@ -1,7 +1,7 @@
-From b49ce922afa13fe8ea5d847753dfb7641b70c9a4 Mon Sep 17 00:00:00 2001
+From ebbf23ac8c19224b34523e8b9820e32f0789fe11 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 12 Jan 2023 15:18:19 +0800
-Subject: [PATCH 12/15] hostapd: mtk: Add he_ldpc configuration
+Subject: [PATCH 13/16] hostapd: mtk: Add he_ldpc configuration
 
 ---
  hostapd/config_file.c        | 2 ++
@@ -13,7 +13,7 @@
  6 files changed, 19 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 10ea52518..4237a5cca 100644
+index 10ea525..4237a5c 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -3508,6 +3508,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -26,7 +26,7 @@
  		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
  		conf->he_op.he_bss_color_disabled = 0;
 diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
-index ea67aa100..e3a5eb365 100644
+index ea67aa1..e3a5eb3 100644
 --- a/hostapd/hostapd.conf
 +++ b/hostapd/hostapd.conf
 @@ -830,6 +830,11 @@ wmm_ac_vo_acm=0
@@ -42,7 +42,7 @@
  #he_bss_color=1
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 85ad5e444..b283de624 100644
+index 85ad5e4..b283de6 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -268,6 +268,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -54,7 +54,7 @@
  		HE_OPERATION_RTS_THRESHOLD_OFFSET;
  	/* Set default basic MCS/NSS set to single stream MCS 0-7 */
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9ac39619..b8b20a7aa 100644
+index a9ac396..b8b20a7 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -929,6 +929,7 @@ struct hostapd_bss_config {
@@ -66,7 +66,7 @@
  	bool he_su_beamformee;
  	bool he_mu_beamformer;
 diff --git a/src/ap/ieee802_11_he.c b/src/ap/ieee802_11_he.c
-index b5b7e5d46..f27aeb196 100644
+index b5b7e5d..f27aeb1 100644
 --- a/src/ap/ieee802_11_he.c
 +++ b/src/ap/ieee802_11_he.c
 @@ -138,6 +138,13 @@ u8 * hostapd_eid_he_capab(struct hostapd_data *hapd, u8 *eid,
@@ -84,7 +84,7 @@
  		cap->he_phy_capab_info[HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX] |=
  			HE_PHYCAP_SU_BEAMFORMER_CAPAB;
 diff --git a/src/common/ieee802_11_defs.h b/src/common/ieee802_11_defs.h
-index 65e125e83..62088bda6 100644
+index 65e125e..62088bd 100644
 --- a/src/common/ieee802_11_defs.h
 +++ b/src/common/ieee802_11_defs.h
 @@ -2298,6 +2298,9 @@ struct ieee80211_spatial_reuse {
@@ -98,5 +98,5 @@
  #define HE_PHYCAP_SU_BEAMFORMER_CAPAB		((u8) BIT(7))
  #define HE_PHYCAP_SU_BEAMFORMEE_CAPAB_IDX	4
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch b/recipes-wifi/hostapd/files/patches/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
deleted file mode 100644
index 1222510..0000000
--- a/recipes-wifi/hostapd/files/patches/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 52a1775318c9926a1dbf4f7c563e95b5be3c9bd6 Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Tue, 17 Jan 2023 13:25:18 +0800
-Subject: [PATCH 13/15] hostapd: mtk: Add the broadcast destination address of
- Probe Response frame on 6 GHz
-
-According to IEEE 802.11ax 26.17.2.3.2,
-if a 6 GHz AP receives a Probe Request frame and responds with a Probe Response frame,
-the Address 1 field of the Probe Response frame shall be set to the broadcast address,
-unless the AP is not indicating its actual SSID in the SSID element of its Beacon frames.
-
-Without this, hostapd fill the Address 1 feild of the Probe Response frame
-with the source address from Probe Request frame on 6 GHz.
-Fix this to use broadcast address instead.
-
-Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
----
- src/ap/beacon.c | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 1a26f11ff..f3ea5c277 100644
---- a/src/ap/beacon.c
-+++ b/src/ap/beacon.c
-@@ -1156,8 +1156,13 @@ void handle_probe_req(struct hostapd_data *hapd,
- 	wpa_msg_ctrl(hapd->msg_ctx, MSG_INFO, RX_PROBE_REQUEST "sa=" MACSTR
- 		     " signal=%d", MAC2STR(mgmt->sa), ssi_signal);
- 
--	resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
--				      &resp_len, false);
-+	if (is_6ghz_op_class(hapd->iconf->op_class) &&
-+	    is_broadcast_ether_addr(mgmt->da))
-+		resp = hostapd_gen_probe_resp(hapd, NULL, elems.p2p != NULL,
-+					      &resp_len, true);
-+	else
-+		resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
-+					      &resp_len, false);
- 	if (resp == NULL)
- 		return;
- 
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch b/recipes-wifi/hostapd/files/patches/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
similarity index 89%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
copy to recipes-wifi/hostapd/files/patches/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
index 1222510..f0d25c6 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
@@ -1,7 +1,7 @@
-From 52a1775318c9926a1dbf4f7c563e95b5be3c9bd6 Mon Sep 17 00:00:00 2001
+From bb5cb086162828392a04820063ad7997d8ae26d7 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 17 Jan 2023 13:25:18 +0800
-Subject: [PATCH 13/15] hostapd: mtk: Add the broadcast destination address of
+Subject: [PATCH 14/16] hostapd: mtk: Add the broadcast destination address of
  Probe Response frame on 6 GHz
 
 According to IEEE 802.11ax 26.17.2.3.2,
@@ -19,7 +19,7 @@
  1 file changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 1a26f11ff..f3ea5c277 100644
+index 1a26f11..f3ea5c2 100644
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
 @@ -1156,8 +1156,13 @@ void handle_probe_req(struct hostapd_data *hapd,
@@ -39,5 +39,5 @@
  		return;
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch b/recipes-wifi/hostapd/files/patches/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
deleted file mode 100644
index 3689f74..0000000
--- a/recipes-wifi/hostapd/files/patches/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 7d741c99f2e211abe70593ff6e8265633bed0d8a Mon Sep 17 00:00:00 2001
-From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
-Date: Tue, 24 Jan 2023 19:06:44 +0800
-Subject: [PATCH 14/15] hostapd: mtk: Add vendor command attribute for RTS BW
- signaling.
-
-Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
----
- src/common/mtk_vendor.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9e2..fb12895ce 100644
---- a/src/common/mtk_vendor.h
-+++ b/src/common/mtk_vendor.h
-@@ -169,6 +169,7 @@ enum mtk_vendor_attr_wireless_ctrl {
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_RTS_SIGTA,
- 
- 	/* keep last */
- 	NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch b/recipes-wifi/hostapd/files/patches/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch
deleted file mode 100644
index 642c625..0000000
--- a/recipes-wifi/hostapd/files/patches/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 619075bb430c908c61a818c45e36f1ca76020741 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 13 Feb 2023 11:03:53 +0800
-Subject: [PATCH 15/15] hostapd: mtk: 6G band does not require DFS
-
----
- src/ap/dfs.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index 1c3f6785b..4b1e64246 100644
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -1506,6 +1506,7 @@ int hostapd_is_dfs_required(struct hostapd_iface *iface)
- 	if ((!(iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD) &&
- 	     !iface->conf->ieee80211h) ||
- 	    !iface->current_mode ||
-+	    is_6ghz_freq(iface->freq) ||
- 	    iface->current_mode->mode != HOSTAPD_MODE_IEEE80211A)
- 		return 0;
- 
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch b/recipes-wifi/hostapd/files/patches/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
similarity index 79%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
copy to recipes-wifi/hostapd/files/patches/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
index 3689f74..5fcd0c5 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
@@ -1,7 +1,7 @@
-From 7d741c99f2e211abe70593ff6e8265633bed0d8a Mon Sep 17 00:00:00 2001
+From 1db373190399a907b27141c199841aeafd4643da Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Tue, 24 Jan 2023 19:06:44 +0800
-Subject: [PATCH 14/15] hostapd: mtk: Add vendor command attribute for RTS BW
+Subject: [PATCH 15/16] hostapd: mtk: Add vendor command attribute for RTS BW
  signaling.
 
 Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9e2..fb12895ce 100644
+index 0999ea9..fb12895 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -169,6 +169,7 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -22,5 +22,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch b/recipes-wifi/hostapd/files/patches/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
similarity index 76%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch
copy to recipes-wifi/hostapd/files/patches/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
index 642c625..33fea78 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
@@ -1,14 +1,14 @@
-From 619075bb430c908c61a818c45e36f1ca76020741 Mon Sep 17 00:00:00 2001
+From efa1d271d28c84b8ca77ffc3ca7cb75e727088a0 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 13 Feb 2023 11:03:53 +0800
-Subject: [PATCH 15/15] hostapd: mtk: 6G band does not require DFS
+Subject: [PATCH 16/16] hostapd: mtk: 6G band does not require DFS
 
 ---
  src/ap/dfs.c | 1 +
  1 file changed, 1 insertion(+)
 
 diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index 1c3f6785b..4b1e64246 100644
+index 1c3f678..4b1e642 100644
 --- a/src/ap/dfs.c
 +++ b/src/ap/dfs.c
 @@ -1506,6 +1506,7 @@ int hostapd_is_dfs_required(struct hostapd_iface *iface)
@@ -20,5 +20,5 @@
  		return 0;
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch b/recipes-wifi/hostapd/files/patches/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
new file mode 100644
index 0000000..265c37a
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
@@ -0,0 +1,46 @@
+From f6bfd9a4a6c0d08e0dec9311873c9e863a07c9a8 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 11:01:18 +0800
+Subject: [PATCH] hostapd: mtk: Fix sending wrong VHT operation IE in CSA while
+ using ZWDFS
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ src/ap/dfs.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 4b1e642..307a4e1 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1110,6 +1110,14 @@ static int
+ hostapd_dfs_start_channel_switch_background(struct hostapd_iface *iface)
+ {
+ 	u8 current_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
++	int ret;
++
++	ret = hostapd_dfs_request_channel_switch(iface, iface->radar_background.channel,
++						 iface->radar_background.freq,
++						 iface->radar_background.secondary_channel,
++						 current_vht_oper_chwidth,
++						 iface->radar_background.centr_freq_seg0_idx,
++						 iface->radar_background.centr_freq_seg1_idx);
+ 
+ 	iface->conf->channel = iface->radar_background.channel;
+ 	iface->freq = iface->radar_background.freq;
+@@ -1122,11 +1130,7 @@ hostapd_dfs_start_channel_switch_background(struct hostapd_iface *iface)
+ 
+ 	hostpad_dfs_update_background_chain(iface);
+ 
+-	return hostapd_dfs_request_channel_switch(
+-		iface, iface->conf->channel, iface->freq,
+-		iface->conf->secondary_channel, current_vht_oper_chwidth,
+-		hostapd_get_oper_centr_freq_seg0_idx(iface->conf),
+-		hostapd_get_oper_centr_freq_seg1_idx(iface->conf));
++	return ret;
+ }
+ 
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch b/recipes-wifi/hostapd/files/patches/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
new file mode 100644
index 0000000..db3c813
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
@@ -0,0 +1,189 @@
+From 3337e7b4f75a66e53e1320e49deba2b58a8a80b0 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 10:51:47 +0800
+Subject: [PATCH 18/19] hostapd: mtk: Add sta-assisted DFS state update
+ mechanism
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ src/ap/dfs.c                       | 20 ++++++++++++++++++++
+ src/ap/dfs.h                       |  3 +++
+ src/ap/drv_callbacks.c             | 28 ++++++++++++++++++++++++++++
+ src/common/wpa_ctrl.h              |  1 +
+ src/drivers/driver.h               | 14 ++++++++++++++
+ src/drivers/driver_nl80211_event.c |  6 ++++++
+ src/drivers/nl80211_copy.h         |  6 ++++++
+ 7 files changed, 78 insertions(+)
+
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 307a4e1..d082fe0 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1503,6 +1503,26 @@ int hostapd_dfs_nop_finished(struct hostapd_iface *iface, int freq,
+ }
+ 
+ 
++int hostapd_dfs_sta_update_state(struct hostapd_iface *iface, int freq,
++				 int ht_enabled, int chan_offset, int chan_width,
++				 int cf1, int cf2, u32 state)
++{
++	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_STA_UPDATE
++		"freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d state=%s",
++		freq, ht_enabled, chan_offset, chan_width, cf1, cf2,
++		(state == HOSTAPD_CHAN_DFS_AVAILABLE) ? "available" : "usable");
++
++	/* Proceed only if DFS is not offloaded to the driver */
++	if (iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD)
++		return 0;
++
++	set_dfs_state(iface, freq, ht_enabled, chan_offset, chan_width,
++		      cf1, cf2, state);
++
++	return 0;
++}
++
++
+ int hostapd_is_dfs_required(struct hostapd_iface *iface)
+ {
+ 	int n_chans, n_chans1, start_chan_idx, start_chan_idx1, res;
+diff --git a/src/ap/dfs.h b/src/ap/dfs.h
+index c2556d2..25ba29c 100644
+--- a/src/ap/dfs.h
++++ b/src/ap/dfs.h
+@@ -30,6 +30,9 @@ int hostapd_dfs_radar_detected(struct hostapd_iface *iface, int freq,
+ int hostapd_dfs_nop_finished(struct hostapd_iface *iface, int freq,
+ 			     int ht_enabled,
+ 			     int chan_offset, int chan_width, int cf1, int cf2);
++int hostapd_dfs_sta_update_state(struct hostapd_iface *iface, int freq,
++				 int ht_enabled, int chan_offset, int chan_width,
++				 int cf1, int cf2, u32 state);
+ int hostapd_is_dfs_required(struct hostapd_iface *iface);
+ int hostapd_is_dfs_chan_available(struct hostapd_iface *iface);
+ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+diff --git a/src/ap/drv_callbacks.c b/src/ap/drv_callbacks.c
+index 09783cb..275f6b3 100644
+--- a/src/ap/drv_callbacks.c
++++ b/src/ap/drv_callbacks.c
+@@ -1790,6 +1790,24 @@ static void hostapd_event_dfs_cac_started(struct hostapd_data *hapd,
+ 			      radar->cf1, radar->cf2);
+ }
+ 
++static void hostapd_event_dfs_sta_cac_skipped(struct hostapd_data *hapd,
++					      struct dfs_event *radar)
++{
++	wpa_printf(MSG_DEBUG, "DFS CAC skipped (by STA) on %d MHz", radar->freq);
++	hostapd_dfs_sta_update_state(hapd->iface, radar->freq, radar->ht_enabled,
++				     radar->chan_offset, radar->chan_width,
++				     radar->cf1, radar->cf2, HOSTAPD_CHAN_DFS_AVAILABLE);
++}
++
++static void hostapd_event_dfs_sta_cac_expired(struct hostapd_data *hapd,
++					      struct dfs_event *radar)
++{
++	wpa_printf(MSG_DEBUG, "DFS CAC expired (by STA) on %d MHz", radar->freq);
++	hostapd_dfs_sta_update_state(hapd->iface, radar->freq, radar->ht_enabled,
++				     radar->chan_offset, radar->chan_width,
++				     radar->cf1, radar->cf2, HOSTAPD_CHAN_DFS_USABLE);
++}
++
+ #endif /* NEED_AP_MLME */
+ 
+ 
+@@ -2064,6 +2082,16 @@ void hostapd_wpa_event(void *ctx, enum wpa_event_type event,
+ 			break;
+ 		hostapd_event_dfs_nop_finished(hapd, &data->dfs_event);
+ 		break;
++	case EVENT_DFS_STA_CAC_SKIPPED:
++		if (!data)
++			break;
++		hostapd_event_dfs_sta_cac_skipped(hapd, &data->dfs_event);
++		break;
++	case EVENT_DFS_STA_CAC_EXPIRED:
++		if (!data)
++			break;
++		hostapd_event_dfs_sta_cac_expired(hapd, &data->dfs_event);
++		break;
+ 	case EVENT_CHANNEL_LIST_CHANGED:
+ 		/* channel list changed (regulatory?), update channel list */
+ 		/* TODO: check this. hostapd_get_hw_features() initializes
+diff --git a/src/common/wpa_ctrl.h b/src/common/wpa_ctrl.h
+index 3435084..79c8a82 100644
+--- a/src/common/wpa_ctrl.h
++++ b/src/common/wpa_ctrl.h
+@@ -360,6 +360,7 @@ extern "C" {
+ #define DFS_EVENT_CAC_COMPLETED "DFS-CAC-COMPLETED "
+ #define DFS_EVENT_NOP_FINISHED "DFS-NOP-FINISHED "
+ #define DFS_EVENT_PRE_CAC_EXPIRED "DFS-PRE-CAC-EXPIRED "
++#define DFS_EVENT_STA_UPDATE "DFS-STA-UPDATE "
+ 
+ #define AP_CSA_FINISHED "AP-CSA-FINISHED "
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 265d86d..b5de0e6 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -5317,6 +5317,20 @@ enum wpa_event_type {
+ 	 * EVENT_CCA_NOTIFY - Notification that CCA has completed
+ 	 */
+ 	EVENT_CCA_NOTIFY,
++
++	/**
++	 * EVENT_DFS_STA_CAC_SKIPPED - Notification that CAC has been skipped
++	 *
++	 * The channel in the notification is now marked as available.
++	 */
++	EVENT_DFS_STA_CAC_SKIPPED,
++
++	/**
++	 * EVENT_DFS_STA_CAC_EXPIRED - Notification that CAC has expired
++	 *
++	 * The channel in the notification is now marked as usable.
++	 */
++	EVENT_DFS_STA_CAC_EXPIRED,
+ };
+ 
+ 
+diff --git a/src/drivers/driver_nl80211_event.c b/src/drivers/driver_nl80211_event.c
+index 73bb7a4..ee922ac 100644
+--- a/src/drivers/driver_nl80211_event.c
++++ b/src/drivers/driver_nl80211_event.c
+@@ -1854,6 +1854,12 @@ static void nl80211_radar_event(struct wpa_driver_nl80211_data *drv,
+ 	case NL80211_RADAR_CAC_STARTED:
+ 		wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_STARTED, &data);
+ 		break;
++	case NL80211_RADAR_STA_CAC_SKIPPED:
++		wpa_supplicant_event(drv->ctx, EVENT_DFS_STA_CAC_SKIPPED, &data);
++		break;
++	case NL80211_RADAR_STA_CAC_EXPIRED:
++		wpa_supplicant_event(drv->ctx, EVENT_DFS_STA_CAC_EXPIRED, &data);
++		break;
+ 	default:
+ 		wpa_printf(MSG_DEBUG, "nl80211: Unknown radar event %d "
+ 			   "received", event_type);
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index c4bf3ad..0937752 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -6431,6 +6431,10 @@ enum nl80211_smps_mode {
+  *	applicable for ETSI dfs domain where pre-CAC is valid for ever.
+  * @NL80211_RADAR_CAC_STARTED: Channel Availability Check has been started,
+  *	should be generated by HW if NL80211_EXT_FEATURE_DFS_OFFLOAD is enabled.
++ * @NL80211_RADAR_STA_CAC_SKIPPED: STA set the DFS state to available
++ *	when receiving CSA/assoc resp
++ * @NL80211_RADAR_STA_CAC_EXPIRED: STA set the DFS state to usable
++ *	when STA is disconnected or leaving the channel
+  */
+ enum nl80211_radar_event {
+ 	NL80211_RADAR_DETECTED,
+@@ -6439,6 +6443,8 @@ enum nl80211_radar_event {
+ 	NL80211_RADAR_NOP_FINISHED,
+ 	NL80211_RADAR_PRE_CAC_EXPIRED,
+ 	NL80211_RADAR_CAC_STARTED,
++	NL80211_RADAR_STA_CAC_SKIPPED,
++	NL80211_RADAR_STA_CAC_EXPIRED,
+ };
+ 
+ /**
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch b/recipes-wifi/hostapd/files/patches/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
new file mode 100644
index 0000000..8340fd9
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
@@ -0,0 +1,43 @@
+From 83ab1a9cc51225095842d3c62bf75cf4efe63075 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 16:58:20 +0800
+Subject: [PATCH] hostapd: mtk: Fix auto ht issue when switching to DFS channel
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 0ad8451..407790f 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -2698,6 +2698,12 @@ static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
+ 		break;
+ 	}
+ 
++	if (os_strstr(pos, " auto-ht")) {
++		settings.freq_params.ht_enabled = iface->conf->ieee80211n;
++		settings.freq_params.vht_enabled = iface->conf->ieee80211ac;
++		settings.freq_params.he_enabled = iface->conf->ieee80211ax;
++	}
++
+ 	if (settings.freq_params.center_freq1)
+ 		dfs_range += hostapd_is_dfs_overlap(
+ 			iface, bandwidth, settings.freq_params.center_freq1);
+@@ -2735,12 +2741,6 @@ static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
+ 		return 0;
+ 	}
+ 
+-	if (os_strstr(pos, " auto-ht")) {
+-		settings.freq_params.ht_enabled = iface->conf->ieee80211n;
+-		settings.freq_params.vht_enabled = iface->conf->ieee80211ac;
+-		settings.freq_params.he_enabled = iface->conf->ieee80211ax;
+-	}
+-
+ 	for (i = 0; i < iface->num_bss; i++) {
+ 
+ 		/* Save CHAN_SWITCH VHT, HE, and EHT config */
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches/patches.inc b/recipes-wifi/hostapd/files/patches/patches.inc
index b2f59b9..872f470 100644
--- a/recipes-wifi/hostapd/files/patches/patches.inc
+++ b/recipes-wifi/hostapd/files/patches/patches.inc
@@ -71,10 +71,14 @@
     file://mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch \
     file://mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch \
     file://mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch \
-    file://mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch \
-    file://mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch \
-    file://mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch \
-    file://mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch \
-    file://mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch \
-    file://mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch \
+    file://mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch \
+    file://mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch \
+    file://mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch \
+    file://mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch \
+    file://mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch \
+    file://mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch \
+    file://mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch \
+    file://mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch \
+    file://mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch \
+    file://mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch \
     "
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch
index 4bd3d4c..b802960 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-wifi-mac80211-mesh-fast-xmit-support.patch
@@ -1,33 +1,32 @@
-From: Sriram R <quic_srirrama@quicinc.com>
-Date: Thu, 18 Aug 2022 12:35:42 +0530
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 26 Feb 2023 13:53:08 +0100
 Subject: [PATCH] wifi: mac80211: mesh fast xmit support
 
-Currently fast xmit is supported in AP, STA and other device types where
-the destination doesn't change for the lifetime of its association by
-caching the static parts of the header that can be reused directly for
-every Tx such as addresses and updates only mutable header fields such as
-PN.
-This technique is not directly applicable for a Mesh device type due
-to the dynamic nature of the topology and protocol. The header is built
-based on the destination mesh device which is proxying a certain external
-device and based on the Mesh destination the next hop changes.
-And the RA/A1 which is the next hop for reaching the destination can
-vary during runtime as per the best route based on airtime.  To accommodate
-these changes and to come up with a solution to avoid overhead during header
-generation, the headers comprising the MAC, Mesh and LLC part are cached
-whenever data for a certain external destination is sent.
-This cached header is reused every time a data is sent to that external
-destination.
+Previously, fast xmit only worked on interface types where initially a
+sta lookup is performed, and a cached header can be attached to the sta,
+requiring only some fields to be updated at runtime.
+
+This technique is not directly applicable for a mesh device type due
+to the dynamic nature of the topology and protocol. There are more
+addresses that need to be filled, and there is an extra header with a
+dynamic length based on the addressing mode.
+
+Change the code to cache entries contain a copy of the mesh subframe header +
+bridge tunnel header, as well as an embedded struct ieee80211_fast_tx, which
+contains the information for building the 802.11 header.
+
+Add a mesh specific early fast xmit call, which looks up a cached entry and
+adds only the mesh subframe header, before passing it over to the generic
+fast xmit code.
 
 To ensure the changes in network are reflected in these cached headers,
 flush affected cached entries on path changes, as well as other conditions
 that currently trigger a fast xmit check in other modes (key changes etc.)
 
-In order to keep the cache small, use a short timeout for expiring cache
-entries.
+This code is loosely based on a previous implementation by:
+Sriram R <quic_srirrama@quicinc.com>
 
-Co-developed-by: Felix Fietkau <nbd@nbd.name>
-Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
 Signed-off-by: Felix Fietkau <nbd@nbd.name>
 ---
 
@@ -37,24 +36,23 @@
  extern const struct cfg80211_ops mac80211_config_ops;
  
  struct ieee80211_local;
-+struct mhdr_cache_entry;
++struct ieee80211_mesh_fast_tx;
  
  /* Maximum number of broadcast/multicast frames to buffer when some of the
   * associated stations are using power saving. */
-@@ -655,6 +656,20 @@ struct mesh_table {
+@@ -655,6 +656,19 @@ struct mesh_table {
  	atomic_t entries;		/* Up to MAX_MESH_NEIGHBOURS */
  };
  
 +/**
-+ * struct mesh_hdr_cache - mesh fast xmit header cache
++ * struct mesh_tx_cache - mesh fast xmit header cache
 + *
-+ * @rhead: hash table containing struct mhdr_cache_entry, using skb DA as key
-+ * @walk_head: linked list containing all mhdr_cache_entry objects
-+ * @walk_lock: lock protecting walk_head and rhead
-+ * @enabled: indicates if header cache is initialized
++ * @rht: hash table containing struct ieee80211_mesh_fast_tx, using skb DA as key
++ * @walk_head: linked list containing all ieee80211_mesh_fast_tx objects
++ * @walk_lock: lock protecting walk_head and rht
 + */
-+struct mesh_hdr_cache {
-+	struct rhashtable rhead;
++struct mesh_tx_cache {
++	struct rhashtable rht;
 +	struct hlist_head walk_head;
 +	spinlock_t walk_lock;
 +};
@@ -62,145 +60,270 @@
  struct ieee80211_if_mesh {
  	struct timer_list housekeeping_timer;
  	struct timer_list mesh_path_timer;
-@@ -733,6 +748,7 @@ struct ieee80211_if_mesh {
+@@ -733,6 +747,7 @@ struct ieee80211_if_mesh {
  	struct mesh_table mpp_paths; /* Store paths for MPP&MAP */
  	int mesh_paths_generation;
  	int mpp_paths_generation;
-+	struct mesh_hdr_cache hdr_cache;
++	struct mesh_tx_cache tx_cache;
  };
  
  #ifdef CPTCFG_MAC80211_MESH
-@@ -1998,6 +2014,9 @@ int ieee80211_tx_control_port(struct wip
+@@ -1998,6 +2013,11 @@ int ieee80211_tx_control_port(struct wip
  			      int link_id, u64 *cookie);
  int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
  			      const u8 *buf, size_t len);
-+void __ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata,
-+				struct mhdr_cache_entry *entry,
-+				struct sk_buff *skb);
++void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
++			   struct sta_info *sta,
++			   struct ieee80211_fast_tx *fast_tx,
++			   struct sk_buff *skb, bool ampdu,
++			   const u8 *da, const u8 *sa);
  
  /* HT */
  void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
 --- a/net/mac80211/mesh.c
 +++ b/net/mac80211/mesh.c
-@@ -780,6 +780,8 @@ static void ieee80211_mesh_housekeeping(
+@@ -10,6 +10,7 @@
+ #include <asm/unaligned.h>
+ #include "ieee80211_i.h"
+ #include "mesh.h"
++#include "wme.h"
+ #include "driver-ops.h"
+ 
+ static int mesh_allocated;
+@@ -698,6 +699,102 @@ ieee80211_mesh_update_bss_params(struct
+ 			__le32_to_cpu(he_oper->he_oper_params);
+ }
+ 
++bool ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata,
++			      struct sk_buff *skb, u32 ctrl_flags)
++{
++	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
++	struct ieee80211_mesh_fast_tx *entry;
++	struct ieee80211s_hdr *meshhdr;
++	u8 sa[ETH_ALEN] __aligned(2);
++	struct tid_ampdu_tx *tid_tx;
++	struct sta_info *sta;
++	bool copy_sa = false;
++	u16 ethertype;
++	u8 tid;
++
++	if (ctrl_flags & IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP)
++		return false;
++
++	if (ifmsh->mshcfg.dot11MeshNolearn)
++		return false;
++
++	/* Add support for these cases later */
++	if (ifmsh->ps_peers_light_sleep || ifmsh->ps_peers_deep_sleep)
++		return false;
++
++	if (is_multicast_ether_addr(skb->data))
++		return false;
++
++	ethertype = (skb->data[12] << 8) | skb->data[13];
++	if (ethertype < ETH_P_802_3_MIN)
++		return false;
++
++	if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
++		return false;
++
++	if (skb->ip_summed == CHECKSUM_PARTIAL) {
++		skb_set_transport_header(skb, skb_checksum_start_offset(skb));
++		if (skb_checksum_help(skb))
++			return false;
++	}
++
++	entry = mesh_fast_tx_get(sdata, skb->data);
++	if (!entry)
++		return false;
++
++	if (skb_headroom(skb) + 2 * ETH_ALEN < entry->hdrlen +
++					       entry->fast_tx.hdr_len)
++		return false;
++
++	sta = rcu_dereference(entry->mpath->next_hop);
++	if (!sta)
++		return false;
++
++	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
++	if (tid_tx) {
++		if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
++			return false;
++		if (tid_tx->timeout)
++			tid_tx->last_tx = jiffies;
++	}
++
++	/* If the skb is shared we need to obtain our own copy */
++	if (skb_shared(skb)) {
++		struct sk_buff *oskb = skb;
++
++		skb = skb_clone(skb, GFP_ATOMIC);
++		if (!skb)
++			return false;
++
++		kfree_skb(oskb);
++	}
++
++	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
++
++	meshhdr = (struct ieee80211s_hdr *)entry->hdr;
++	if ((meshhdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6) {
++		/* preserve SA from eth header for 6-addr frames */
++		ether_addr_copy(sa, skb->data + ETH_ALEN);
++		copy_sa = true;
++	}
++
++	memcpy(skb_push(skb, entry->hdrlen - 2 * ETH_ALEN), entry->hdr,
++	       entry->hdrlen);
++
++	meshhdr = (struct ieee80211s_hdr *)skb->data;
++	put_unaligned_le32(atomic_inc_return(&sdata->u.mesh.mesh_seqnum),
++			   &meshhdr->seqnum);
++	meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
++	if (copy_sa)
++	    ether_addr_copy(meshhdr->eaddr2, sa);
++
++	__ieee80211_xmit_fast(sdata, sta, &entry->fast_tx, skb, tid_tx,
++			      entry->mpath->dst, sdata->vif.addr);
++
++	return true;
++}
++
+ /**
+  * ieee80211_fill_mesh_addresses - fill addresses of a locally originated mesh frame
+  * @hdr:	802.11 frame header
+@@ -780,6 +877,8 @@ static void ieee80211_mesh_housekeeping(
  	changed = mesh_accept_plinks_update(sdata);
  	ieee80211_mbss_info_change_notify(sdata, changed);
  
-+	mesh_hdr_cache_gc(sdata);
++	mesh_fast_tx_gc(sdata);
 +
  	mod_timer(&ifmsh->housekeeping_timer,
  		  round_jiffies(jiffies +
  				IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
 --- a/net/mac80211/mesh.h
 +++ b/net/mac80211/mesh.h
-@@ -122,11 +122,49 @@ struct mesh_path {
+@@ -122,11 +122,41 @@ struct mesh_path {
  	u8 rann_snd_addr[ETH_ALEN];
  	u32 rann_metric;
  	unsigned long last_preq_to_root;
-+	unsigned long fast_xmit_check;
++	unsigned long fast_tx_check;
  	bool is_root;
  	bool is_gate;
  	u32 path_change_count;
  };
  
-+#define MESH_HEADER_CACHE_MAX_SIZE		512
-+#define MESH_HEADER_CACHE_THRESHOLD_SIZE	384
-+#define MESH_HEADER_CACHE_TIMEOUT		8000 /* msecs */
-+#define MESH_HEADER_MAX_LEN			68   /* mac+mesh+rfc1042 hdr */
++#define MESH_FAST_TX_CACHE_MAX_SIZE		512
++#define MESH_FAST_TX_CACHE_THRESHOLD_SIZE	384
++#define MESH_FAST_TX_CACHE_TIMEOUT		8000 /* msecs */
 +
 +/**
-+ * struct mhdr_cache_entry - Cached Mesh header entry
-+ * @addr_key: The Ethernet DA which is the key for this entry
-+ * @hdr: The cached header
-+ * @machdr_len: Total length of the mac header
-+ * @hdrlen: Length of this header entry
-+ * @key: Key corresponding to the nexthop stored in the header
-+ * @pn_offs: Offset to PN which is updated for every xmit
-+ * @band:  band used for tx
-+ * @walk_list: list containing all the cached header entries
++ * struct ieee80211_mesh_fast_tx - cached mesh fast tx entry
 + * @rhash: rhashtable pointer
-+ * @mpath: The Mesh path corresponding to the Mesh DA
-+ * @mppath: The MPP entry corresponding to this DA
++ * @addr_key: The Ethernet DA which is the key for this entry
++ * @fast_tx: base fast_tx data
++ * @hdr: cached mesh and rfc1042 headers
++ * @hdrlen: length of mesh + rfc1042
++ * @walk_list: list containing all the fast tx entries
++ * @mpath: mesh path corresponding to the Mesh DA
++ * @mppath: MPP entry corresponding to this DA
 + * @timestamp: Last used time of this entry
-+ * @rcu: rcu to free this entry
-+ * @path_change_count: Stored path change value corresponding to the mpath
 + */
-+struct mhdr_cache_entry {
++struct ieee80211_mesh_fast_tx {
++	struct rhash_head rhash;
 +	u8 addr_key[ETH_ALEN] __aligned(2);
-+	u8 hdr[MESH_HEADER_MAX_LEN];
-+	u16 machdr_len;
++
++	struct ieee80211_fast_tx fast_tx;
++	u8 hdr[sizeof(struct ieee80211s_hdr) + sizeof(rfc1042_header)];
 +	u16 hdrlen;
-+	u8 pn_offs;
-+	u8 band;
-+	struct ieee80211_key __rcu *key;
-+	struct hlist_node walk_list;
-+	struct rhash_head rhash;
++
 +	struct mesh_path *mpath, *mppath;
++	struct hlist_node walk_list;
 +	unsigned long timestamp;
-+	struct rcu_head rcu;
 +};
 +
  /* Recent multicast cache */
  /* RMC_BUCKETS must be a power of 2, maximum 256 */
  #define RMC_BUCKETS		256
-@@ -298,6 +336,15 @@ void mesh_path_discard_frame(struct ieee
+@@ -298,6 +328,20 @@ void mesh_path_discard_frame(struct ieee
  void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata);
  
  bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt);
-+struct mhdr_cache_entry *
-+mesh_get_cached_hdr(struct ieee80211_sub_if_data *sdata, const u8 *addr);
-+void mesh_cache_hdr(struct ieee80211_sub_if_data *sdata,
-+		    struct sk_buff *skb, struct mesh_path *mpath);
-+void mesh_hdr_cache_gc(struct ieee80211_sub_if_data *sdata);
-+void mesh_hdr_cache_flush(struct ieee80211_sub_if_data *sdata, const u8 *addr,
-+			  bool is_mpp);
-+void mesh_refresh_path(struct ieee80211_sub_if_data *sdata,
++struct ieee80211_mesh_fast_tx *
++mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata, const u8 *addr);
++bool ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata,
++			      struct sk_buff *skb, u32 ctrl_flags);
++void mesh_fast_tx_cache(struct ieee80211_sub_if_data *sdata,
++			struct sk_buff *skb, struct mesh_path *mpath);
++void mesh_fast_tx_gc(struct ieee80211_sub_if_data *sdata);
++void mesh_fast_tx_flush_addr(struct ieee80211_sub_if_data *sdata,
++			     const u8 *addr);
++void mesh_fast_tx_flush_mpath(struct mesh_path *mpath);
++void mesh_fast_tx_flush_sta(struct ieee80211_sub_if_data *sdata,
++			    struct sta_info *sta);
++void mesh_path_refresh(struct ieee80211_sub_if_data *sdata,
 +		       struct mesh_path *mpath, const u8 *addr);
  
  #ifdef CPTCFG_MAC80211_MESH
  static inline
 --- a/net/mac80211/mesh_hwmp.c
 +++ b/net/mac80211/mesh_hwmp.c
-@@ -491,8 +491,11 @@ static u32 hwmp_route_info_get(struct ie
+@@ -394,6 +394,7 @@ static u32 hwmp_route_info_get(struct ie
+ 	u32 orig_sn, orig_metric;
+ 	unsigned long orig_lifetime, exp_time;
+ 	u32 last_hop_metric, new_metric;
++	bool flush_mpath = false;
+ 	bool process = true;
+ 	u8 hopcount;
+ 
+@@ -491,8 +492,10 @@ static u32 hwmp_route_info_get(struct ie
  		}
  
  		if (fresh_info) {
 -			if (rcu_access_pointer(mpath->next_hop) != sta)
 +			if (rcu_access_pointer(mpath->next_hop) != sta) {
  				mpath->path_change_count++;
-+				mesh_hdr_cache_flush(mpath->sdata, mpath->dst,
-+						     false);
++				flush_mpath = true;
 +			}
  			mesh_path_assign_nexthop(mpath, sta);
  			mpath->flags |= MESH_PATH_SN_VALID;
  			mpath->metric = new_metric;
-@@ -539,8 +542,11 @@ static u32 hwmp_route_info_get(struct ie
+@@ -502,6 +505,8 @@ static u32 hwmp_route_info_get(struct ie
+ 			mpath->hop_count = hopcount;
+ 			mesh_path_activate(mpath);
+ 			spin_unlock_bh(&mpath->state_lock);
++			if (flush_mpath)
++				mesh_fast_tx_flush_mpath(mpath);
+ 			ewma_mesh_fail_avg_init(&sta->mesh->fail_avg);
+ 			/* init it at a low value - 0 start is tricky */
+ 			ewma_mesh_fail_avg_add(&sta->mesh->fail_avg, 1);
+@@ -539,8 +544,10 @@ static u32 hwmp_route_info_get(struct ie
  		}
  
  		if (fresh_info) {
 -			if (rcu_access_pointer(mpath->next_hop) != sta)
 +			if (rcu_access_pointer(mpath->next_hop) != sta) {
  				mpath->path_change_count++;
-+				mesh_hdr_cache_flush(mpath->sdata, mpath->dst,
-+						     false);
++				flush_mpath = true;
 +			}
  			mesh_path_assign_nexthop(mpath, sta);
  			mpath->metric = last_hop_metric;
  			mpath->exp_time = time_after(mpath->exp_time, exp_time)
-@@ -977,7 +983,7 @@ free:
-  * Locking: the function must be called from within a rcu read lock block.
-  *
-  */
--static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
-+void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
- {
- 	struct ieee80211_sub_if_data *sdata = mpath->sdata;
- 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-@@ -1215,6 +1221,20 @@ static int mesh_nexthop_lookup_nolearn(s
+@@ -548,6 +555,8 @@ static u32 hwmp_route_info_get(struct ie
+ 			mpath->hop_count = 1;
+ 			mesh_path_activate(mpath);
+ 			spin_unlock_bh(&mpath->state_lock);
++			if (flush_mpath)
++				mesh_fast_tx_flush_mpath(mpath);
+ 			ewma_mesh_fail_avg_init(&sta->mesh->fail_avg);
+ 			/* init it at a low value - 0 start is tricky */
+ 			ewma_mesh_fail_avg_add(&sta->mesh->fail_avg, 1);
+@@ -1215,6 +1224,20 @@ static int mesh_nexthop_lookup_nolearn(s
  	return 0;
  }
  
-+void mesh_refresh_path(struct ieee80211_sub_if_data *sdata,
++void mesh_path_refresh(struct ieee80211_sub_if_data *sdata,
 +		       struct mesh_path *mpath, const u8 *addr)
 +{
 +	if (mpath->flags & (MESH_PATH_REQ_QUEUED | MESH_PATH_FIXED |
@@ -217,7 +340,7 @@
  /**
   * mesh_nexthop_lookup - put the appropriate next hop on a mesh frame. Calling
   * this function is considered "using" the associated mpath, so preempt a path
-@@ -1242,19 +1262,18 @@ int mesh_nexthop_lookup(struct ieee80211
+@@ -1242,19 +1265,15 @@ int mesh_nexthop_lookup(struct ieee80211
  	if (!mpath || !(mpath->flags & MESH_PATH_ACTIVE))
  		return -ENOENT;
  
@@ -228,18 +351,15 @@
 -	    !(mpath->flags & MESH_PATH_RESOLVING) &&
 -	    !(mpath->flags & MESH_PATH_FIXED))
 -		mesh_queue_preq(mpath, PREQ_Q_F_START | PREQ_Q_F_REFRESH);
-+	mesh_refresh_path(sdata, mpath, hdr->addr4);
++	mesh_path_refresh(sdata, mpath, hdr->addr4);
  
  	next_hop = rcu_dereference(mpath->next_hop);
  	if (next_hop) {
  		memcpy(hdr->addr1, next_hop->sta.addr, ETH_ALEN);
  		memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
  		ieee80211_mps_set_frame_flags(sdata, next_hop, hdr);
-+		/* Cache the whole header so as to use next time rather than resolving
-+		 * and building it every time
-+		 */
 +		if (ieee80211_hw_check(&sdata->local->hw, SUPPORT_FAST_XMIT))
-+			mesh_cache_hdr(sdata, skb, mpath);
++			mesh_fast_tx_cache(sdata, skb, mpath);
  		return 0;
  	}
  
@@ -257,37 +377,37 @@
  	.hashfn = mesh_table_hash,
  };
  
-+static const struct rhashtable_params mesh_hdr_rht_params = {
++static const struct rhashtable_params fast_tx_rht_params = {
 +	.nelem_hint = 10,
 +	.automatic_shrinking = true,
-+	.key_len =  ETH_ALEN,
-+	.key_offset = offsetof(struct mhdr_cache_entry, addr_key),
-+	.head_offset = offsetof(struct mhdr_cache_entry, rhash),
++	.key_len = ETH_ALEN,
++	.key_offset = offsetof(struct ieee80211_mesh_fast_tx, addr_key),
++	.head_offset = offsetof(struct ieee80211_mesh_fast_tx, rhash),
 +	.hashfn = mesh_table_hash,
 +};
 +
-+static void __mesh_hdr_cache_entry_free(void *ptr, void *tblptr)
++static void __mesh_fast_tx_entry_free(void *ptr, void *tblptr)
 +{
-+	struct mhdr_cache_entry *mhdr = ptr;
++	struct ieee80211_mesh_fast_tx *entry = ptr;
 +
-+	kfree_rcu(mhdr, rcu);
++	kfree_rcu(entry, fast_tx.rcu_head);
 +}
 +
-+static void mesh_hdr_cache_deinit(struct ieee80211_sub_if_data *sdata)
++static void mesh_fast_tx_deinit(struct ieee80211_sub_if_data *sdata)
 +{
-+	struct mesh_hdr_cache *cache;
++	struct mesh_tx_cache *cache;
 +
-+	cache = &sdata->u.mesh.hdr_cache;
-+	rhashtable_free_and_destroy(&cache->rhead,
-+				    __mesh_hdr_cache_entry_free, NULL);
++	cache = &sdata->u.mesh.tx_cache;
++	rhashtable_free_and_destroy(&cache->rht,
++				    __mesh_fast_tx_entry_free, NULL);
 +}
 +
-+static void mesh_hdr_cache_init(struct ieee80211_sub_if_data *sdata)
++static void mesh_fast_tx_init(struct ieee80211_sub_if_data *sdata)
 +{
-+	struct mesh_hdr_cache *cache;
++	struct mesh_tx_cache *cache;
 +
-+	cache = &sdata->u.mesh.hdr_cache;
-+	rhashtable_init(&cache->rhead, &mesh_hdr_rht_params);
++	cache = &sdata->u.mesh.tx_cache;
++	rhashtable_init(&cache->rht, &fast_tx_rht_params);
 +	INIT_HLIST_HEAD(&cache->walk_head);
 +	spin_lock_init(&cache->walk_lock);
 +}
@@ -295,66 +415,75 @@
  static inline bool mpath_expired(struct mesh_path *mpath)
  {
  	return (mpath->flags & MESH_PATH_ACTIVE) &&
-@@ -381,6 +417,211 @@ struct mesh_path *mesh_path_new(struct i
+@@ -381,6 +417,243 @@ struct mesh_path *mesh_path_new(struct i
  	return new_mpath;
  }
  
-+struct mhdr_cache_entry *
-+mesh_get_cached_hdr(struct ieee80211_sub_if_data *sdata, const u8 *addr)
++static void mesh_fast_tx_entry_free(struct mesh_tx_cache *cache,
++				    struct ieee80211_mesh_fast_tx *entry)
 +{
-+	struct mesh_path *mpath, *mppath;
-+	struct mhdr_cache_entry *entry;
-+	struct mesh_hdr_cache *cache;
++	hlist_del_rcu(&entry->walk_list);
++	rhashtable_remove_fast(&cache->rht, &entry->rhash, fast_tx_rht_params);
++	kfree_rcu(entry, fast_tx.rcu_head);
++}
++
++struct ieee80211_mesh_fast_tx *
++mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata, const u8 *addr)
++{
++	struct ieee80211_mesh_fast_tx *entry;
++	struct mesh_tx_cache *cache;
 +
-+	cache = &sdata->u.mesh.hdr_cache;
-+	entry = rhashtable_lookup(&cache->rhead, addr, mesh_hdr_rht_params);
++	cache = &sdata->u.mesh.tx_cache;
++	entry = rhashtable_lookup(&cache->rht, addr, fast_tx_rht_params);
 +	if (!entry)
 +		return NULL;
 +
-+	mpath = rcu_dereference(entry->mpath);
-+	mppath = rcu_dereference(entry->mppath);
-+	if (!(mpath->flags & MESH_PATH_ACTIVE) || mpath_expired(mpath))
++	if (!(entry->mpath->flags & MESH_PATH_ACTIVE) ||
++	    mpath_expired(entry->mpath)) {
++		spin_lock_bh(&cache->walk_lock);
++		entry = rhashtable_lookup(&cache->rht, addr, fast_tx_rht_params);
++		if (entry)
++		    mesh_fast_tx_entry_free(cache, entry);
++		spin_unlock_bh(&cache->walk_lock);
 +		return NULL;
++	}
 +
-+	mesh_refresh_path(sdata, mpath, NULL);
-+	if (mppath)
-+		mppath->exp_time = jiffies;
++	mesh_path_refresh(sdata, entry->mpath, NULL);
++	if (entry->mppath)
++		entry->mppath->exp_time = jiffies;
 +	entry->timestamp = jiffies;
 +
 +	return entry;
 +}
 +
-+void mesh_cache_hdr(struct ieee80211_sub_if_data *sdata,
-+		    struct sk_buff *skb, struct mesh_path *mpath)
++void mesh_fast_tx_cache(struct ieee80211_sub_if_data *sdata,
++			struct sk_buff *skb, struct mesh_path *mpath)
 +{
 +	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 +	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct mesh_hdr_cache *cache;
-+	struct mhdr_cache_entry *mhdr, *old_mhdr;
++	struct ieee80211_mesh_fast_tx *entry, *prev;
++	struct ieee80211_mesh_fast_tx build = {};
 +	struct ieee80211s_hdr *meshhdr;
-+	struct sta_info *next_hop;
++	struct mesh_tx_cache *cache;
 +	struct ieee80211_key *key;
 +	struct mesh_path *mppath;
-+	u16 meshhdr_len;
-+	u8 pn_offs = 0;
-+	int hdrlen;
-+
-+	if (sdata->noack_map)
-+		return;
++	struct sta_info *sta;
++	u8 *qc;
 +
-+	if (!ieee80211_is_data_qos(hdr->frame_control))
++	if (sdata->noack_map ||
++	    !ieee80211_is_data_qos(hdr->frame_control))
 +		return;
 +
-+	hdrlen = ieee80211_hdrlen(hdr->frame_control);
-+	meshhdr = (struct ieee80211s_hdr *)(skb->data + hdrlen);
-+	meshhdr_len = ieee80211_get_mesh_hdrlen(meshhdr);
++	build.fast_tx.hdr_len = ieee80211_hdrlen(hdr->frame_control);
++	meshhdr = (struct ieee80211s_hdr *)(skb->data + build.fast_tx.hdr_len);
++	build.hdrlen = ieee80211_get_mesh_hdrlen(meshhdr);
 +
-+	cache = &sdata->u.mesh.hdr_cache;
-+	if (atomic_read(&cache->rhead.nelems) >= MESH_HEADER_CACHE_MAX_SIZE)
++	cache = &sdata->u.mesh.tx_cache;
++	if (atomic_read(&cache->rht.nelems) >= MESH_FAST_TX_CACHE_MAX_SIZE)
 +		return;
 +
-+	next_hop = rcu_dereference(mpath->next_hop);
-+	if (!next_hop)
++	sta = rcu_dereference(mpath->next_hop);
++	if (!sta)
 +		return;
 +
 +	if ((meshhdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6) {
@@ -362,6 +491,7 @@
 +		mppath = mpp_path_lookup(sdata, meshhdr->eaddr1);
 +		if (!mppath)
 +			return;
++		build.mppath = mppath;
 +	} else if (ieee80211_has_a4(hdr->frame_control)) {
 +		mppath = mpath;
 +	} else {
@@ -369,14 +499,20 @@
 +	}
 +
 +	/* rate limit, in case fast xmit can't be enabled */
-+	if (mppath->fast_xmit_check == jiffies)
++	if (mppath->fast_tx_check == jiffies)
 +		return;
 +
-+	mppath->fast_xmit_check = jiffies;
++	mppath->fast_tx_check = jiffies;
 +
-+	key = rcu_access_pointer(next_hop->ptk[next_hop->ptk_idx]);
++	/*
++	 * Same use of the sta lock as in ieee80211_check_fast_xmit, in order
++	 * to protect against concurrent sta key updates.
++	 */
++	spin_lock_bh(&sta->lock);
++	key = rcu_access_pointer(sta->ptk[sta->ptk_idx]);
 +	if (!key)
 +		key = rcu_access_pointer(sdata->default_unicast_key);
++	build.fast_tx.key = key;
 +
 +	if (key) {
 +		bool gen_iv, iv_spc;
@@ -386,157 +522,184 @@
 +
 +		if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) ||
 +		    (key->flags & KEY_FLAG_TAINTED))
-+			return;
++			goto unlock_sta;
 +
 +		switch (key->conf.cipher) {
 +		case WLAN_CIPHER_SUITE_CCMP:
 +		case WLAN_CIPHER_SUITE_CCMP_256:
 +			if (gen_iv)
-+				pn_offs = hdrlen;
++				build.fast_tx.pn_offs = build.fast_tx.hdr_len;
 +			if (gen_iv || iv_spc)
-+				hdrlen += IEEE80211_CCMP_HDR_LEN;
++				build.fast_tx.hdr_len += IEEE80211_CCMP_HDR_LEN;
 +			break;
 +		case WLAN_CIPHER_SUITE_GCMP:
 +		case WLAN_CIPHER_SUITE_GCMP_256:
 +			if (gen_iv)
-+				pn_offs = hdrlen;
++				build.fast_tx.pn_offs = build.fast_tx.hdr_len;
 +			if (gen_iv || iv_spc)
-+				hdrlen += IEEE80211_GCMP_HDR_LEN;
++				build.fast_tx.hdr_len += IEEE80211_GCMP_HDR_LEN;
 +			break;
 +		default:
-+			return;
++			goto unlock_sta;
 +		}
 +	}
 +
-+	if (WARN_ON_ONCE(hdrlen + meshhdr_len + sizeof(rfc1042_header) >
-+			 MESH_HEADER_MAX_LEN))
-+		return;
++	memcpy(build.addr_key, mppath->dst, ETH_ALEN);
++	build.timestamp = jiffies;
++	build.fast_tx.band = info->band;
++	build.fast_tx.da_offs = offsetof(struct ieee80211_hdr, addr3);
++	build.fast_tx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
++	build.mpath = mpath;
++	memcpy(build.hdr, meshhdr, build.hdrlen);
++	memcpy(build.hdr + build.hdrlen, rfc1042_header, sizeof(rfc1042_header));
++	build.hdrlen += sizeof(rfc1042_header);
++	memcpy(build.fast_tx.hdr, hdr, build.fast_tx.hdr_len);
 +
-+	mhdr = kzalloc(sizeof(*mhdr), GFP_ATOMIC);
-+	if (!mhdr)
-+		return;
++	hdr = (struct ieee80211_hdr *)build.fast_tx.hdr;
++	if (build.fast_tx.key)
++		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 +
-+	memcpy(mhdr->addr_key, mppath->dst, ETH_ALEN);
-+	mhdr->machdr_len = hdrlen;
-+	mhdr->hdrlen = mhdr->machdr_len + meshhdr_len + sizeof(rfc1042_header);
-+	rcu_assign_pointer(mhdr->mpath, mpath);
-+	if (meshhdr->flags & MESH_FLAGS_AE)
-+		rcu_assign_pointer(mhdr->mppath, mppath);
-+	rcu_assign_pointer(mhdr->key, key);
-+	mhdr->timestamp = jiffies;
-+	mhdr->band = info->band;
-+	mhdr->pn_offs = pn_offs;
++	qc = ieee80211_get_qos_ctl(hdr);
++	qc[1] |= IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT >> 8;
 +
-+	if (pn_offs) {
-+		memcpy(mhdr->hdr, skb->data, pn_offs);
-+		memcpy(mhdr->hdr + mhdr->machdr_len, skb->data + pn_offs,
-+		       mhdr->hdrlen - mhdr->machdr_len);
-+	} else {
-+		memcpy(mhdr->hdr, skb->data, mhdr->hdrlen);
++	entry = kmemdup(&build, sizeof(build), GFP_ATOMIC);
++	if (!entry)
++		goto unlock_sta;
++
++	spin_lock_bh(&cache->walk_lock);
++	prev = rhashtable_lookup_get_insert_fast(&cache->rht,
++						 &entry->rhash,
++						 fast_tx_rht_params);
++	if (unlikely(IS_ERR(prev))) {
++		kfree(entry);
++		goto unlock_cache;
 +	}
 +
-+	if (key) {
-+		hdr = (struct ieee80211_hdr *)mhdr->hdr;
-+		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
++	/*
++	 * replace any previous entry in the hash table, in case we're
++	 * replacing it with a different type (e.g. mpath -> mpp)
++	 */
++	if (unlikely(prev)) {
++		rhashtable_replace_fast(&cache->rht, &prev->rhash,
++					&entry->rhash, fast_tx_rht_params);
++		hlist_del_rcu(&prev->walk_list);
++		kfree_rcu(prev, fast_tx.rcu_head);
 +	}
 +
-+	spin_lock_bh(&cache->walk_lock);
-+	old_mhdr = rhashtable_lookup_get_insert_fast(&cache->rhead,
-+						     &mhdr->rhash,
-+						     mesh_hdr_rht_params);
-+	if (likely(!old_mhdr))
-+		hlist_add_head(&mhdr->walk_list, &cache->walk_head);
-+	else
-+		kfree(mhdr);
-+	spin_unlock_bh(&cache->walk_lock);
-+}
++	hlist_add_head(&entry->walk_list, &cache->walk_head);
 +
-+static void mesh_hdr_cache_entry_free(struct mesh_hdr_cache *cache,
-+				      struct mhdr_cache_entry *entry)
-+{
-+	hlist_del_rcu(&entry->walk_list);
-+	rhashtable_remove_fast(&cache->rhead, &entry->rhash, mesh_hdr_rht_params);
-+	kfree_rcu(entry, rcu);
++unlock_cache:
++	spin_unlock_bh(&cache->walk_lock);
++unlock_sta:
++	spin_unlock_bh(&sta->lock);
 +}
 +
-+void mesh_hdr_cache_gc(struct ieee80211_sub_if_data *sdata)
++void mesh_fast_tx_gc(struct ieee80211_sub_if_data *sdata)
 +{
-+	unsigned long timeout = msecs_to_jiffies(MESH_HEADER_CACHE_TIMEOUT);
-+	struct mesh_hdr_cache *cache;
-+	struct mhdr_cache_entry *entry;
++	unsigned long timeout = msecs_to_jiffies(MESH_FAST_TX_CACHE_TIMEOUT);
++	struct mesh_tx_cache *cache;
++	struct ieee80211_mesh_fast_tx *entry;
 +	struct hlist_node *n;
 +
-+	cache = &sdata->u.mesh.hdr_cache;
-+	if (atomic_read(&cache->rhead.nelems) < MESH_HEADER_CACHE_THRESHOLD_SIZE)
++	cache = &sdata->u.mesh.tx_cache;
++	if (atomic_read(&cache->rht.nelems) < MESH_FAST_TX_CACHE_THRESHOLD_SIZE)
 +		return;
 +
 +	spin_lock_bh(&cache->walk_lock);
 +	hlist_for_each_entry_safe(entry, n, &cache->walk_head, walk_list)
 +		if (!time_is_after_jiffies(entry->timestamp + timeout))
-+			mesh_hdr_cache_entry_free(cache, entry);
++			mesh_fast_tx_entry_free(cache, entry);
 +	spin_unlock_bh(&cache->walk_lock);
 +}
 +
-+void mesh_hdr_cache_flush(struct ieee80211_sub_if_data *sdata, const u8 *addr,
-+			  bool is_mpp)
++void mesh_fast_tx_flush_mpath(struct mesh_path *mpath)
 +{
-+	struct mesh_hdr_cache *cache = &sdata->u.mesh.hdr_cache;
-+	struct mhdr_cache_entry *entry;
++	struct ieee80211_sub_if_data *sdata = mpath->sdata;
++	struct mesh_tx_cache *cache = &sdata->u.mesh.tx_cache;
++	struct ieee80211_mesh_fast_tx *entry;
 +	struct hlist_node *n;
 +
-+	cache = &sdata->u.mesh.hdr_cache;
++	cache = &sdata->u.mesh.tx_cache;
 +	spin_lock_bh(&cache->walk_lock);
++	hlist_for_each_entry_safe(entry, n, &cache->walk_head, walk_list)
++		if (entry->mpath == mpath)
++			mesh_fast_tx_entry_free(cache, entry);
++	spin_unlock_bh(&cache->walk_lock);
++}
 +
-+	/* Only one header per mpp address is expected in the header cache */
-+	if (is_mpp) {
-+		entry = rhashtable_lookup(&cache->rhead, addr,
-+					  mesh_hdr_rht_params);
-+		if (entry)
-+			mesh_hdr_cache_entry_free(cache, entry);
-+		goto out;
-+	}
++void mesh_fast_tx_flush_sta(struct ieee80211_sub_if_data *sdata,
++			    struct sta_info *sta)
++{
++	struct mesh_tx_cache *cache = &sdata->u.mesh.tx_cache;
++	struct ieee80211_mesh_fast_tx *entry;
++	struct hlist_node *n;
 +
++	cache = &sdata->u.mesh.tx_cache;
++	spin_lock_bh(&cache->walk_lock);
 +	hlist_for_each_entry_safe(entry, n, &cache->walk_head, walk_list)
-+		if (ether_addr_equal(entry->mpath->dst, addr))
-+			mesh_hdr_cache_entry_free(cache, entry);
++		if (rcu_access_pointer(entry->mpath->next_hop) == sta)
++			mesh_fast_tx_entry_free(cache, entry);
++	spin_unlock_bh(&cache->walk_lock);
++}
++
++void mesh_fast_tx_flush_addr(struct ieee80211_sub_if_data *sdata,
++			     const u8 *addr)
++{
++	struct mesh_tx_cache *cache = &sdata->u.mesh.tx_cache;
++	struct ieee80211_mesh_fast_tx *entry;
 +
-+out:
++	cache = &sdata->u.mesh.tx_cache;
++	spin_lock_bh(&cache->walk_lock);
++	entry = rhashtable_lookup(&cache->rht, addr, fast_tx_rht_params);
++	if (entry)
++		mesh_fast_tx_entry_free(cache, entry);
 +	spin_unlock_bh(&cache->walk_lock);
 +}
 +
  /**
   * mesh_path_add - allocate and add a new path to the mesh path table
   * @dst: destination address of the path (ETH_ALEN length)
-@@ -521,6 +762,8 @@ static void mesh_path_free_rcu(struct me
+@@ -464,6 +737,8 @@ int mpp_path_add(struct ieee80211_sub_if
+ 
+ 	if (ret)
+ 		kfree(new_mpath);
++	else
++		mesh_fast_tx_flush_addr(sdata, dst);
  
- static void __mesh_path_del(struct mesh_table *tbl, struct mesh_path *mpath)
+ 	sdata->u.mesh.mpp_paths_generation++;
+ 	return ret;
+@@ -523,6 +798,10 @@ static void __mesh_path_del(struct mesh_
  {
-+	mesh_hdr_cache_flush(mpath->sdata, mpath->dst,
-+			     tbl == &mpath->sdata->u.mesh.mpp_paths);
  	hlist_del_rcu(&mpath->walk_list);
  	rhashtable_remove_fast(&tbl->rhead, &mpath->rhash, mesh_rht_params);
++	if (tbl == &mpath->sdata->u.mesh.mpp_paths)
++		mesh_fast_tx_flush_addr(mpath->sdata, mpath->dst);
++	else
++		mesh_fast_tx_flush_mpath(mpath);
  	mesh_path_free_rcu(tbl, mpath);
-@@ -747,6 +990,7 @@ void mesh_path_fix_nexthop(struct mesh_p
+ }
+ 
+@@ -747,6 +1026,7 @@ void mesh_path_fix_nexthop(struct mesh_p
  	mpath->exp_time = 0;
  	mpath->flags = MESH_PATH_FIXED | MESH_PATH_SN_VALID;
  	mesh_path_activate(mpath);
-+	mesh_hdr_cache_flush(mpath->sdata, mpath->dst, false);
++	mesh_fast_tx_flush_mpath(mpath);
  	spin_unlock_bh(&mpath->state_lock);
  	ewma_mesh_fail_avg_init(&next_hop->mesh->fail_avg);
  	/* init it at a low value - 0 start is tricky */
-@@ -758,6 +1002,7 @@ void mesh_pathtbl_init(struct ieee80211_
+@@ -758,6 +1038,7 @@ void mesh_pathtbl_init(struct ieee80211_
  {
  	mesh_table_init(&sdata->u.mesh.mesh_paths);
  	mesh_table_init(&sdata->u.mesh.mpp_paths);
-+	mesh_hdr_cache_init(sdata);
++	mesh_fast_tx_init(sdata);
  }
  
  static
-@@ -785,6 +1030,7 @@ void mesh_path_expire(struct ieee80211_s
+@@ -785,6 +1066,7 @@ void mesh_path_expire(struct ieee80211_s
  
  void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata)
  {
-+	mesh_hdr_cache_deinit(sdata);
++	mesh_fast_tx_deinit(sdata);
  	mesh_table_free(&sdata->u.mesh.mesh_paths);
  	mesh_table_free(&sdata->u.mesh.mpp_paths);
  }
@@ -565,7 +728,7 @@
 +
 +		/* flush fast xmit cache if the address path changed */
 +		if (update)
-+			mesh_hdr_cache_flush(sdata, proxied_addr, true);
++			mesh_fast_tx_flush_addr(sdata, proxied_addr);
 +
  		rcu_read_unlock();
  	}
@@ -577,168 +740,105 @@
  		return;
  
 +	if (ieee80211_vif_is_mesh(&sdata->vif))
-+		mesh_hdr_cache_flush(sdata, sta->addr, false);
++		mesh_fast_tx_flush_sta(sdata, sta);
 +
  	/* Locking here protects both the pointer itself, and against concurrent
  	 * invocations winning data access races to, e.g., the key pointer that
  	 * is used.
-@@ -3723,6 +3726,155 @@ free:
- 	kfree_skb(skb);
- }
+@@ -3402,6 +3405,9 @@ static bool ieee80211_amsdu_aggregate(st
+ 	if (sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
+ 		return false;
  
-+void __ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata,
-+				struct mhdr_cache_entry *entry,
-+				struct sk_buff *skb)
-+{
-+	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_tx_data tx = {};
-+	struct ieee80211_tx_info *info;
-+	struct ieee80211_key *key;
-+	struct ieee80211_hdr *hdr;
-+	struct mesh_path *mpath;
-+	ieee80211_tx_result r;
-+	struct sta_info *sta;
-+	u8 tid;
-+
-+	if (!IS_ENABLED(CPTCFG_MAC80211_MESH))
-+		return;
-+
-+	info = IEEE80211_SKB_CB(skb);
-+	memset(info, 0, sizeof(*info));
-+	info->band = entry->band;
-+	info->control.vif = &sdata->vif;
-+	info->flags = IEEE80211_TX_CTL_FIRST_FRAGMENT |
-+		      IEEE80211_TX_CTL_DONTFRAG;
-+
-+	info->control.flags = IEEE80211_TX_CTRL_FAST_XMIT;
-+
-+#ifdef CONFIG_MAC80211_DEBUGFS
-+	if (local->force_tx_status)
-+		info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
-+#endif
-+
-+	mpath = entry->mpath;
-+	key = entry->key;
-+	sta = rcu_dereference(mpath->next_hop);
-+
-+	__skb_queue_head_init(&tx.skbs);
-+
-+	tx.flags = IEEE80211_TX_UNICAST;
-+	tx.local = local;
-+	tx.sdata = sdata;
-+	tx.sta = sta;
-+	tx.key = key;
-+	tx.skb = skb;
-+
-+	hdr = (struct ieee80211_hdr *)skb->data;
-+	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
-+	*ieee80211_get_qos_ctl(hdr) = tid;
-+
-+	ieee80211_aggr_check(sdata, sta, skb);
-+
-+	if (ieee80211_queue_skb(local, sdata, sta, skb))
-+		return;
-+
-+	r = ieee80211_xmit_fast_finish(sdata, sta, entry->pn_offs, key, &tx);
-+	if (r == TX_DROP) {
-+		kfree_skb(skb);
-+		return;
-+	}
-+
-+	__skb_queue_tail(&tx.skbs, skb);
-+	ieee80211_tx_frags(local, &sdata->vif, sta, &tx.skbs, false);
-+}
-+
-+
-+static bool ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata,
-+				     struct sk_buff *skb, u32 ctrl_flags)
-+{
-+	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-+	struct mhdr_cache_entry *entry;
-+	struct ieee80211s_hdr *meshhdr;
-+	u8 sa[ETH_ALEN] __aligned(2);
-+	struct sta_info *sta;
-+	bool copy_sa = false;
-+	u16 ethertype;
-+
-+	if (ctrl_flags & IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP)
-+		return false;
-+
-+	if (ifmsh->mshcfg.dot11MeshNolearn)
-+		return false;
-+
-+	if (!ieee80211_hw_check(&local->hw, SUPPORT_FAST_XMIT))
-+		return false;
-+
-+	/* Add support for these cases later */
-+	if (ifmsh->ps_peers_light_sleep || ifmsh->ps_peers_deep_sleep)
-+		return false;
-+
-+	if (is_multicast_ether_addr(skb->data))
-+		return false;
-+
-+	ethertype = (skb->data[12] << 8) | skb->data[13];
-+	if (ethertype < ETH_P_802_3_MIN)
-+		return false;
-+
-+	if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
-+		return false;
-+
-+	if (skb->ip_summed == CHECKSUM_PARTIAL) {
-+		skb_set_transport_header(skb, skb_checksum_start_offset(skb));
-+		if (skb_checksum_help(skb))
-+			return false;
-+	}
-+
-+	entry = mesh_get_cached_hdr(sdata, skb->data);
-+	if (!entry)
-+		return false;
-+
-+	/* Avoid extra work in this path */
-+	if (skb_headroom(skb) < (entry->hdrlen - ETH_HLEN + 2))
++	if (ieee80211_vif_is_mesh(&sdata->vif))
 +		return false;
 +
-+	/* If the skb is shared we need to obtain our own copy */
-+	if (skb_shared(skb)) {
-+		struct sk_buff *oskb = skb;
-+
-+		skb = skb_clone(skb, GFP_ATOMIC);
-+		if (!skb)
-+			return false;
-+
-+		kfree_skb(oskb);
-+	}
-+
-+	sta = rcu_dereference(entry->mpath->next_hop);
-+	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
-+
-+	meshhdr = (struct ieee80211s_hdr *)(entry->hdr + entry->machdr_len);
-+	if ((meshhdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6) {
-+		/* preserve SA from eth header for 6-addr frames */
-+		ether_addr_copy(sa, skb->data + ETH_ALEN);
-+		copy_sa = true;
-+	}
-+
-+	memcpy(skb_push(skb, entry->hdrlen - 2 * ETH_ALEN), entry->hdr,
-+	       entry->hdrlen);
-+
-+	meshhdr = (struct ieee80211s_hdr *)(skb->data + entry->machdr_len);
-+	put_unaligned_le32(atomic_inc_return(&sdata->u.mesh.mesh_seqnum),
-+			   &meshhdr->seqnum);
-+	meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
-+	if (copy_sa)
-+	    ether_addr_copy(meshhdr->eaddr2, sa);
-+
-+	__ieee80211_mesh_xmit_fast(sdata, entry, skb);
-+
-+	return true;
-+}
+ 	if (skb_is_gso(skb))
+ 		return false;
+ 
+@@ -3634,10 +3640,11 @@ free:
+ 	return NULL;
+ }
+ 
+-static void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
+-				  struct sta_info *sta,
+-				  struct ieee80211_fast_tx *fast_tx,
+-				  struct sk_buff *skb, u8 tid, bool ampdu)
++void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
++			   struct sta_info *sta,
++			   struct ieee80211_fast_tx *fast_tx,
++			   struct sk_buff *skb, bool ampdu,
++			   const u8 *da, const u8 *sa)
+ {
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
+@@ -3645,8 +3652,6 @@ static void __ieee80211_xmit_fast(struct
+ 	struct ieee80211_tx_data tx;
+ 	ieee80211_tx_result r;
+ 	int hw_headroom = sdata->local->hw.extra_tx_headroom;
+-	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
+-	struct ethhdr eth;
+ 
+ 	skb = skb_share_check(skb, GFP_ATOMIC);
+ 	if (unlikely(!skb))
+@@ -3661,16 +3666,15 @@ static void __ieee80211_xmit_fast(struct
+ 	 * more room than we already have in 'extra_head'
+ 	 */
+ 	if (unlikely(ieee80211_skb_resize(sdata, skb,
+-					  max_t(int, extra_head + hw_headroom -
++					  max_t(int, fast_tx->hdr_len + hw_headroom -
+ 						     skb_headroom(skb), 0),
+ 					  ENCRYPT_NO)))
+ 		goto free;
+ 
+-	memcpy(&eth, skb->data, ETH_HLEN - 2);
+-	hdr = skb_push(skb, extra_head);
++	hdr = skb_push(skb, fast_tx->hdr_len);
+ 	memcpy(skb->data, fast_tx->hdr, fast_tx->hdr_len);
+-	memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
+-	memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);
++	memcpy(skb->data + fast_tx->da_offs, da, ETH_ALEN);
++	memcpy(skb->data + fast_tx->sa_offs, sa, ETH_ALEN);
+ 
+ 	info = IEEE80211_SKB_CB(skb);
+ 	memset(info, 0, sizeof(*info));
+@@ -3689,7 +3693,7 @@ static void __ieee80211_xmit_fast(struct
+ #endif
+ 
+ 	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
+-		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++		u8 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
+ 		*ieee80211_get_qos_ctl(hdr) = tid;
+ 	}
+ 
+@@ -3732,6 +3736,7 @@ static bool ieee80211_xmit_fast(struct i
+ 	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
+ 	struct tid_ampdu_tx *tid_tx = NULL;
+ 	struct sk_buff *next;
++	struct ethhdr eth;
+ 	u8 tid = IEEE80211_NUM_TIDS;
+ 
+ 	/* control port protocol needs a lot of special handling */
+@@ -3757,14 +3762,18 @@ static bool ieee80211_xmit_fast(struct i
+ 		}
+ 	}
+ 
++	memcpy(&eth, skb->data, ETH_HLEN - 2);
 +
- static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
- 				struct sta_info *sta,
- 				struct ieee80211_fast_tx *fast_tx,
-@@ -4244,8 +4396,14 @@ void __ieee80211_subif_start_xmit(struct
+ 	/* after this point (skb is modified) we cannot return false */
++	skb_pull(skb, ETH_HLEN - 2);
+ 	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
+ 	if (!skb)
+ 		return true;
+ 
+ 	skb_list_walk_safe(skb, skb, next) {
+ 		skb_mark_not_on_list(skb);
+-		__ieee80211_xmit_fast(sdata, sta, fast_tx, skb, tid, tid_tx);
++		__ieee80211_xmit_fast(sdata, sta, fast_tx, skb, tid_tx,
++				      eth.h_dest, eth.h_source);
+ 	}
+ 
+ 	return true;
+@@ -4244,8 +4253,15 @@ void __ieee80211_subif_start_xmit(struct
  		return;
  	}
  
@@ -747,13 +847,14 @@
  	rcu_read_lock();
  
 +	if (ieee80211_vif_is_mesh(&sdata->vif) &&
++	    ieee80211_hw_check(&local->hw, SUPPORT_FAST_XMIT) &&
 +	    ieee80211_mesh_xmit_fast(sdata, skb, ctrl_flags))
 +		goto out;
 +
  	if (ieee80211_lookup_ra_sta(sdata, skb, &sta))
  		goto out_free;
  
-@@ -4255,8 +4413,6 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4255,8 +4271,6 @@ void __ieee80211_subif_start_xmit(struct
  	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
  	ieee80211_aggr_check(sdata, sta, skb);
  
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch
index e0d4e60..3b0bae6 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch
@@ -3,40 +3,92 @@
 Subject: [PATCH] wifi: mac80211: use mesh header cache to speed up mesh
  forwarding
 
-Use it to look up the next hop address + sta pointer + key and call
-__ieee80211_mesh_xmit_fast to queue the tx frame.
-
 Significantly reduces mesh forwarding path CPU usage and enables the
-use of iTXQ.
+direct use of iTXQ.
 
 Signed-off-by: Felix Fietkau <nbd@nbd.name>
 ---
 
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -2731,6 +2731,7 @@ ieee80211_rx_mesh_data(struct ieee80211_
- 	struct ieee80211_hdr hdr = {
- 		.frame_control = cpu_to_le16(fc)
- 	};
-+	struct mhdr_cache_entry *entry = NULL;
- 	struct ieee80211_hdr *fwd_hdr;
- 	struct ieee80211s_hdr *mesh_hdr;
- 	struct ieee80211_tx_info *info;
-@@ -2788,7 +2789,12 @@ ieee80211_rx_mesh_data(struct ieee80211_
- 		return RX_DROP_MONITOR;
+@@ -2720,6 +2720,65 @@ ieee80211_deliver_skb(struct ieee80211_r
  	}
+ }
  
--	if (mesh_hdr->flags & MESH_FLAGS_AE) {
++#ifdef CPTCFG_MAC80211_MESH
++static bool
++ieee80211_rx_mesh_fast_forward(struct ieee80211_sub_if_data *sdata,
++			       struct sk_buff *skb, int hdrlen)
++{
++	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
++	struct ieee80211_mesh_fast_tx *entry = NULL;
++	struct ieee80211s_hdr *mesh_hdr;
++	struct tid_ampdu_tx *tid_tx;
++	struct sta_info *sta;
++	struct ethhdr eth;
++	u8 tid;
++
++	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(eth));
 +	if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
-+		entry = mesh_get_cached_hdr(sdata, mesh_hdr->eaddr1);
++		entry = mesh_fast_tx_get(sdata, mesh_hdr->eaddr1);
 +	else if (!(mesh_hdr->flags & MESH_FLAGS_AE))
-+		entry = mesh_get_cached_hdr(sdata, eth->h_dest);
++		entry = mesh_fast_tx_get(sdata, skb->data);
++	if (!entry)
++		return false;
++
++	sta = rcu_dereference(entry->mpath->next_hop);
++	if (!sta)
++		return false;
++
++	if (skb_linearize(skb))
++		return false;
++
++	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
++	if (tid_tx) {
++		if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
++			return false;
++
++		if (tid_tx->timeout)
++			tid_tx->last_tx = jiffies;
++	}
++
++	ieee80211_aggr_check(sdata, sta, skb);
++
++	if (ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,
++					    &skb->protocol))
++		hdrlen += ETH_ALEN;
++	else
++		skb->protocol = htons(skb->len - hdrlen);
++	skb_set_network_header(skb, hdrlen + 2);
++
++	skb->dev = sdata->dev;
++	memcpy(&eth, skb->data, ETH_HLEN - 2);
++	skb_pull(skb, sizeof(eth));
++	__ieee80211_xmit_fast(sdata, sta, &entry->fast_tx, skb, tid_tx,
++			      eth.h_dest, eth.h_source);
++	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
++	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
 +
-+	if (!entry && (mesh_hdr->flags & MESH_FLAGS_AE)) {
- 		struct mesh_path *mppath;
- 		char *proxied_addr;
- 		bool update = false;
-@@ -2862,11 +2868,23 @@ ieee80211_rx_mesh_data(struct ieee80211_
++	return true;
++}
++#endif
++
+ static ieee80211_rx_result
+ ieee80211_rx_mesh_data(struct ieee80211_sub_if_data *sdata, struct sta_info *sta,
+ 		       struct sk_buff *skb)
+@@ -2824,6 +2883,10 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 
+ 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]);
+ 
++	if (!multicast &&
++	    ieee80211_rx_mesh_fast_forward(sdata, skb, mesh_hdrlen))
++		return RX_QUEUED;
++
+ 	ieee80211_fill_mesh_addresses(&hdr, &hdr.frame_control,
+ 				      eth->h_dest, eth->h_source);
+ 	hdrlen = ieee80211_hdrlen(hdr.frame_control);
+@@ -2862,6 +2925,7 @@ ieee80211_rx_mesh_data(struct ieee80211_
  	info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
  	info->control.vif = &sdata->vif;
  	info->control.jiffies = jiffies;
@@ -44,23 +96,7 @@
  	if (multicast) {
  		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
  		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
- 		/* update power mode indication when forwarding */
- 		ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
-+	} else if (entry) {
-+		struct ieee80211_hdr *ehdr = (struct ieee80211_hdr *)entry->hdr;
-+
-+		ether_addr_copy(fwd_hdr->addr1, ehdr->addr1);
-+		ether_addr_copy(fwd_hdr->addr2, sdata->vif.addr);
-+		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
-+		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
-+		qos[0] = fwd_skb->priority;
-+		qos[1] = ieee80211_get_qos_ctl(ehdr)[1];
-+		__ieee80211_mesh_xmit_fast(sdata, entry, fwd_skb);
-+		return RX_QUEUED;
- 	} else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
- 		/* mesh power mode flags updated in mesh_nexthop_lookup */
- 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
-@@ -2883,7 +2901,6 @@ ieee80211_rx_mesh_data(struct ieee80211_
+@@ -2883,7 +2947,6 @@ ieee80211_rx_mesh_data(struct ieee80211_
  	}
  
  	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
@@ -68,3 +104,29 @@
  	ieee80211_add_pending_skb(local, fwd_skb);
  
  rx_accept:
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -2018,6 +2018,8 @@ void __ieee80211_xmit_fast(struct ieee80
+ 			   struct ieee80211_fast_tx *fast_tx,
+ 			   struct sk_buff *skb, bool ampdu,
+ 			   const u8 *da, const u8 *sa);
++void ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
++			  struct sta_info *sta, struct sk_buff *skb);
+ 
+ /* HT */
+ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1191,10 +1191,8 @@ static bool ieee80211_tx_prep_agg(struct
+ 	return queued;
+ }
+ 
+-static void
+-ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
+-		     struct sta_info *sta,
+-		     struct sk_buff *skb)
++void ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
++			  struct sta_info *sta, struct sk_buff *skb)
+ {
+ 	struct rate_control_ref *ref = sdata->local->rate_ctrl;
+ 	u16 tid;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/321-mac80211-fix-mesh-forwarding.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/321-mac80211-fix-mesh-forwarding.patch
index d9af8c7..e2b268a 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/321-mac80211-fix-mesh-forwarding.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/321-mac80211-fix-mesh-forwarding.patch
@@ -11,7 +11,7 @@
 
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -2847,6 +2847,9 @@ ieee80211_rx_mesh_data(struct ieee80211_
+@@ -2904,6 +2904,9 @@ ieee80211_rx_mesh_data(struct ieee80211_
  
  		if (skb_cow_head(fwd_skb, hdrlen - sizeof(struct ethhdr)))
  			return RX_DROP_UNUSABLE;
@@ -21,7 +21,7 @@
  	}
  
  	fwd_hdr = skb_push(fwd_skb, hdrlen - sizeof(struct ethhdr));
-@@ -2861,7 +2864,7 @@ ieee80211_rx_mesh_data(struct ieee80211_
+@@ -2918,7 +2921,7 @@ ieee80211_rx_mesh_data(struct ieee80211_
  		hdrlen += ETH_ALEN;
  	else
  		fwd_skb->protocol = htons(fwd_skb->len - hdrlen);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/322-wifi-mac80211-fix-mesh-path-discovery-based-on-unica.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/322-wifi-mac80211-fix-mesh-path-discovery-based-on-unica.patch
new file mode 100644
index 0000000..292a89e
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/322-wifi-mac80211-fix-mesh-path-discovery-based-on-unica.patch
@@ -0,0 +1,52 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 26 Feb 2023 20:30:20 +0100
+Subject: [PATCH] wifi: mac80211: fix mesh path discovery based on unicast
+ packets
+
+If a packet has reached its intended destination, it was bumped to the code
+that accepts it, without first checking if a mesh_path needs to be created
+based on the discovered source.
+Fix this by moving the destination address check further down
+
+Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2824,17 +2824,6 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	    mesh_rmc_check(sdata, eth->h_source, mesh_hdr))
+ 		return RX_DROP_MONITOR;
+ 
+-	/* Frame has reached destination.  Don't forward */
+-	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
+-		goto rx_accept;
+-
+-	if (!ifmsh->mshcfg.dot11MeshForwarding) {
+-		if (is_multicast_ether_addr(eth->h_dest))
+-			goto rx_accept;
+-
+-		return RX_DROP_MONITOR;
+-	}
+-
+ 	/* forward packet */
+ 	if (sdata->crypto_tx_tailroom_needed_cnt)
+ 		tailroom = IEEE80211_ENCRYPT_TAILROOM;
+@@ -2881,6 +2870,17 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 		rcu_read_unlock();
+ 	}
+ 
++	/* Frame has reached destination.  Don't forward */
++	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
++		goto rx_accept;
++
++	if (!ifmsh->mshcfg.dot11MeshForwarding) {
++		if (is_multicast_ether_addr(eth->h_dest))
++			goto rx_accept;
++
++		return RX_DROP_MONITOR;
++	}
++
+ 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]);
+ 
+ 	if (!multicast &&
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
index 817be9e..80ffb49 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
@@ -87,7 +87,7 @@
  	CFG80211_TESTMODE_DUMP(ieee80211_testmode_dump)
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1536,6 +1536,7 @@ struct ieee80211_local {
+@@ -1535,6 +1535,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
index 45bcf93..db2b20a 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
@@ -26,6 +26,7 @@
     file://319-wifi-mac80211-mesh-fast-xmit-support.patch \
     file://320-wifi-mac80211-use-mesh-header-cache-to-speed-up-mesh.patch \
     file://321-mac80211-fix-mesh-forwarding.patch \
+    file://322-wifi-mac80211-fix-mesh-path-discovery-based-on-unica.patch \
     file://400-allow-ibss-mixed.patch \
     file://500-mac80211_configure_antenna_gain.patch \
     file://782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch \
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0013-mac80211-mtk-check-the-control-channel-before-downgr.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0012-mac80211-mtk-check-the-control-channel-before-downgr.patch
similarity index 91%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0013-mac80211-mtk-check-the-control-channel-before-downgr.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0012-mac80211-mtk-check-the-control-channel-before-downgr.patch
index cf2f1b5..f5903f0 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0013-mac80211-mtk-check-the-control-channel-before-downgr.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0012-mac80211-mtk-check-the-control-channel-before-downgr.patch
@@ -1,7 +1,7 @@
-From 0d87b80d522117ea4c074ff3f7767f76fdd3df2d Mon Sep 17 00:00:00 2001
+From 750e991ce9cf04af982bb11e6058c133d205d879 Mon Sep 17 00:00:00 2001
 From: mtk31095 <michael-cy.lee@mediatek.com>
 Date: Fri, 16 Dec 2022 10:37:53 +0800
-Subject: [PATCH 912/915] mac80211: mtk: check the control channel before
+Subject: [PATCH 12/14] mac80211: mtk: check the control channel before
  downgrading the bandwidth
 
 Signed-off-by: mtk31095 <michael-cy.lee@mediatek.com>
@@ -51,5 +51,5 @@
  		ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
  		ret = ieee80211_vif_use_channel(sdata, &chandef,
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0012-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0012-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
deleted file mode 100644
index b089f6a..0000000
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0012-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
+++ /dev/null
@@ -1,258 +0,0 @@
-From 7aebd936d9c3b2f1d1bbd2d9e9996b67fde989a1 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Wed, 5 Oct 2022 19:13:43 +0800
-Subject: [PATCH 911/915] mac80211: mtk: fix the issue of AP and STA starting
- on DFS channel concurrently
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- include/net/cfg80211.h       | 21 +++++++++++++++++
- include/uapi/linux/nl80211.h |  2 +-
- net/mac80211/cfg.c           | 44 ++++++++++++++++++++++++++++++++++++
- net/mac80211/chan.c          |  2 +-
- net/wireless/chan.c          |  6 ++---
- net/wireless/nl80211.c       |  8 +++++++
- net/wireless/rdev-ops.h      | 16 +++++++++++++
- net/wireless/trace.h         | 15 ++++++++++++
- 8 files changed, 109 insertions(+), 5 deletions(-)
-
-diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
-index b97ddbd..c4c0926 100644
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -800,6 +800,24 @@ cfg80211_chandef_identical(const struct cfg80211_chan_def *chandef1,
- 		chandef1->center_freq2 == chandef2->center_freq2);
- }
- 
-+/**
-+ * cfg80211_chan_fully_overlap - check if two channel are fully overlapped
-+ * @chandef1: first channel definition
-+ * @chandef2: second channel definition
-+ *
-+ * Return: %true if the channels are valid and fully overlapped, %false otherwise.
-+ */
-+static inline bool
-+cfg80211_chan_fully_overlap(const struct cfg80211_chan_def *chandef1,
-+			    const struct cfg80211_chan_def *chandef2)
-+{
-+	return (chandef1->center_freq1 != 0 &&
-+		chandef1->center_freq1 == chandef2->center_freq1 &&
-+		chandef1->width == chandef2->width &&
-+		chandef1->freq1_offset == chandef2->freq1_offset &&
-+		chandef1->center_freq2 == chandef2->center_freq2);
-+}
-+
- /**
-  * cfg80211_chandef_is_edmg - check if chandef represents an EDMG channel
-  *
-@@ -4402,6 +4420,8 @@ struct cfg80211_ops {
- 	int	(*set_radar_background)(struct wiphy *wiphy,
- 					struct cfg80211_chan_def *chandef);
- 	void	(*skip_cac)(struct wireless_dev *wdev);
-+	void	(*check_cac_skip)(struct wiphy *wiphy,
-+				  struct cfg80211_chan_def *chandef);
- };
- 
- /*
-@@ -5555,6 +5575,7 @@ struct wireless_dev {
- 	struct work_struct pmsr_free_wk;
- 
- 	unsigned long unprot_beacon_reported;
-+	bool start_disabled;
- };
- 
- static inline u8 *wdev_address(struct wireless_dev *wdev)
-diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
-index e674aa7..ada8288 100644
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -3129,7 +3129,7 @@ enum nl80211_attrs {
- 	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
- 
- 	/* add attributes here, update the policy in nl80211.c */
--
-+	NL80211_ATTR_START_DISABLED = 999,
- 	__NL80211_ATTR_AFTER_LAST,
- 	NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
- 	NL80211_ATTR_MAX = __NL80211_ATTR_AFTER_LAST - 1
-diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 0a6257d..a7b6284 100644
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -4519,6 +4519,49 @@ ieee80211_skip_cac(struct wireless_dev *wdev)
- 	}
- }
- 
-+static void
-+ieee80211_check_cac_skip(struct wiphy *wiphy,
-+			 struct cfg80211_chan_def *chandef)
-+{
-+	struct ieee80211_local *local = wiphy_priv(wiphy);
-+	struct ieee80211_sub_if_data *s1;
-+	struct ieee80211_sub_if_data *s2;
-+	struct ieee80211_sub_if_data *sdata_sta;
-+	struct ieee80211_if_managed *ifmgd;
-+	struct ieee80211_channel *chan;
-+	struct wireless_dev *wdev;
-+	unsigned int cac_time_ms;
-+
-+	mutex_lock(&local->mtx);
-+	/* Bypass AP's cac if there is a STA associated to the same DFS channel */
-+	list_for_each_entry(s1, &local->interfaces, list) {
-+		ifmgd = &s1->u.mgd;
-+
-+		if (s1->vif.type == NL80211_IFTYPE_STATION && ifmgd->associated)
-+			sdata_sta = s1;
-+		else
-+			continue;
-+
-+		list_for_each_entry(s2, &local->interfaces, list) {
-+			wdev = &s2->wdev;
-+			chan = wdev->chandef.chan;
-+			if (chan) {
-+				if (!(chan->flags & IEEE80211_CHAN_RADAR))
-+					continue;
-+
-+				if (wdev->identifier != sdata_sta->wdev.identifier &&
-+				    chan->dfs_state == NL80211_DFS_USABLE && wdev->cac_started &&
-+				    cfg80211_chan_fully_overlap(&sdata_sta->vif.bss_conf.chandef,
-+								&s2->vif.bss_conf.chandef)) {
-+					ieee80211_skip_cac(wdev);
-+					sdata_info(s2, "Skip CAC on the associated STA's chan\n");
-+				}
-+			}
-+		}
-+	}
-+	mutex_unlock(&local->mtx);
-+}
-+
- const struct cfg80211_ops mac80211_config_ops = {
- 	.add_virtual_intf = ieee80211_add_iface,
- 	.del_virtual_intf = ieee80211_del_iface,
-@@ -4626,4 +4669,5 @@ const struct cfg80211_ops mac80211_config_ops = {
- 	.color_change = ieee80211_color_change,
- 	.set_radar_background = ieee80211_set_radar_background,
- 	.skip_cac = ieee80211_skip_cac,
-+	.check_cac_skip = ieee80211_check_cac_skip,
- };
-diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
-index 63e15f5..5e57e4a 100644
---- a/net/mac80211/chan.c
-+++ b/net/mac80211/chan.c
-@@ -505,7 +505,7 @@ bool ieee80211_is_radar_required(struct ieee80211_local *local)
- 
- 	rcu_read_lock();
- 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
--		if (sdata->radar_required) {
-+		if (sdata->radar_required && sdata->wdev.cac_started) {
- 			rcu_read_unlock();
- 			return true;
- 		}
-diff --git a/net/wireless/chan.c b/net/wireless/chan.c
-index 5f50ac4..067ed79 100644
---- a/net/wireless/chan.c
-+++ b/net/wireless/chan.c
-@@ -664,13 +664,13 @@ bool cfg80211_beaconing_iface_active(struct wireless_dev *wdev)
- 	switch (wdev->iftype) {
- 	case NL80211_IFTYPE_AP:
- 	case NL80211_IFTYPE_P2P_GO:
--		active = wdev->beacon_interval != 0;
-+		active = wdev->beacon_interval != 0 || wdev->start_disabled;
- 		break;
- 	case NL80211_IFTYPE_ADHOC:
--		active = wdev->ssid_len != 0;
-+		active = wdev->ssid_len != 0 || wdev->start_disabled;
- 		break;
- 	case NL80211_IFTYPE_MESH_POINT:
--		active = wdev->mesh_id_len != 0;
-+		active = wdev->mesh_id_len != 0 || wdev->start_disabled;
- 		break;
- 	case NL80211_IFTYPE_STATION:
- 	case NL80211_IFTYPE_OCB:
-diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
-index a20aba5..8dc928d 100644
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -803,6 +803,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
- 			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
- 	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
- 	[NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
-+	[NL80211_ATTR_START_DISABLED] = { .type = NLA_FLAG },
- 	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
- };
- 
-@@ -5547,6 +5548,12 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
- 
- 	memset(&params, 0, sizeof(params));
- 
-+	if (info->attrs[NL80211_ATTR_START_DISABLED]) {
-+		wdev->start_disabled = nla_get_flag(info->attrs[NL80211_ATTR_START_DISABLED]);
-+		err = 0;
-+		goto out;
-+	}
-+
- 	/* these are required for START_AP */
- 	if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
- 	    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
-@@ -9393,6 +9400,7 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
- 		wdev->cac_started = true;
- 		wdev->cac_start_time = jiffies;
- 		wdev->cac_time_ms = cac_time_ms;
-+		err = rdev_check_cac_skip(rdev, &wdev->chandef);
- 	}
- unlock:
- 	wiphy_unlock(wiphy);
-diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
-index 26f4604..c38aea1 100644
---- a/net/wireless/rdev-ops.h
-+++ b/net/wireless/rdev-ops.h
-@@ -1412,4 +1412,20 @@ rdev_skip_cac(struct cfg80211_registered_device *rdev,
- 	return 0;
- }
- 
-+static inline int
-+rdev_check_cac_skip(struct cfg80211_registered_device *rdev,
-+		    struct cfg80211_chan_def *chandef)
-+{
-+	struct wiphy *wiphy = &rdev->wiphy;
-+
-+	if (!rdev->ops->check_cac_skip)
-+		return -EOPNOTSUPP;
-+
-+	trace_rdev_check_cac_skip(wiphy, chandef);
-+	rdev->ops->check_cac_skip(wiphy, chandef);
-+	trace_rdev_return_void(wiphy);
-+
-+	return 0;
-+}
-+
- #endif /* __CFG80211_RDEV_OPS */
-diff --git a/net/wireless/trace.h b/net/wireless/trace.h
-index eadabfa..a7b0c82 100644
---- a/net/wireless/trace.h
-+++ b/net/wireless/trace.h
-@@ -3677,6 +3677,21 @@ TRACE_EVENT(rdev_skip_cac,
- 	    TP_printk(WDEV_PR_FMT, WDEV_PR_ARG)
- );
- 
-+TRACE_EVENT(rdev_check_cac_skip,
-+	    TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
-+
-+	    TP_ARGS(wiphy, chandef),
-+
-+	    TP_STRUCT__entry(WIPHY_ENTRY
-+			     CHAN_DEF_ENTRY),
-+
-+	    TP_fast_assign(WIPHY_ASSIGN;
-+			   CHAN_DEF_ASSIGN(chandef)),
-+
-+	    TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
-+		      WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
-+);
-+
- #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
- 
- #undef TRACE_INCLUDE_PATH
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0014-mac80211-mtk-fix-tx-amsdu-aggregation.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0013-mac80211-mtk-fix-tx-amsdu-aggregation.patch
similarity index 93%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0014-mac80211-mtk-fix-tx-amsdu-aggregation.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0013-mac80211-mtk-fix-tx-amsdu-aggregation.patch
index 371958d..da8632a 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0014-mac80211-mtk-fix-tx-amsdu-aggregation.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0013-mac80211-mtk-fix-tx-amsdu-aggregation.patch
@@ -1,7 +1,7 @@
-From 491811bea8080d41f28438947d51c712ccf91d0e Mon Sep 17 00:00:00 2001
+From b4f6a720d5a0aeaeb2772ce99cf89f7bede959bf Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Wed, 14 Dec 2022 00:26:50 -0800
-Subject: [PATCH 913/915] mac80211: mtk: fix tx amsdu aggregation
+Subject: [PATCH 13/14] mac80211: mtk: fix tx amsdu aggregation
 
 ---
  include/net/mac80211.h | 7 +++++++
@@ -51,5 +51,5 @@
  	capab |= u16_encode_bits(tid, IEEE80211_ADDBA_PARAM_TID_MASK);
  	capab |= u16_encode_bits(agg_size, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0014-mac80211-mtk-add-sta-assisted-DFS-state-update-mecha.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0014-mac80211-mtk-add-sta-assisted-DFS-state-update-mecha.patch
new file mode 100644
index 0000000..2006b27
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0014-mac80211-mtk-add-sta-assisted-DFS-state-update-mecha.patch
@@ -0,0 +1,176 @@
+From 8fdded8b5d47f1ab5fb7ab1fd2a4247cd81edad0 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 14:25:24 +0800
+Subject: [PATCH] mac80211: mtk: add sta-assisted DFS state update mechanism
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ include/net/cfg80211.h       | 14 +++++++++
+ include/uapi/linux/nl80211.h |  6 ++++
+ net/mac80211/mlme.c          | 11 +++++++
+ net/wireless/chan.c          | 60 ++++++++++++++++++++++++++++++++++++
+ 4 files changed, 91 insertions(+)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index b97ddbd..02ad2b2 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -7641,6 +7641,20 @@ void cfg80211_cac_event(struct net_device *netdev,
+ 			const struct cfg80211_chan_def *chandef,
+ 			enum nl80211_radar_event event, gfp_t gfp);
+ 
++/**
++ * cfg80211_sta_update_dfs_state - Update channel's DFS state during STA channel switch,
++ *				   association, and disassociation
++ * @wdev: the wireless device
++ * @bss_chandef: the current BSS channel definition
++ * @csa_chandef: the CSA channel definition
++ * @associated: whether STA is during association or disassociation process
++ *
++ */
++void cfg80211_sta_update_dfs_state(struct wireless_dev *wdev,
++				   const struct cfg80211_chan_def *bss_chandef,
++				   const struct cfg80211_chan_def *csa_chandef,
++				   bool associated);
++
+ /**
+  * cfg80211_background_cac_abort - Channel Availability Check offchan abort event
+  * @wiphy: the wiphy
+diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
+index e674aa7..3e348a5 100644
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -6294,6 +6294,10 @@ enum nl80211_smps_mode {
+  *	applicable for ETSI dfs domain where pre-CAC is valid for ever.
+  * @NL80211_RADAR_CAC_STARTED: Channel Availability Check has been started,
+  *	should be generated by HW if NL80211_EXT_FEATURE_DFS_OFFLOAD is enabled.
++ * @NL80211_RADAR_STA_CAC_SKIPPED: STA set the DFS state to available
++ *	when receiving CSA/assoc resp
++ * @NL80211_RADAR_STA_CAC_EXPIRED: STA set the DFS state to usable
++ *	when STA is disconnected or leaving the channel
+  */
+ enum nl80211_radar_event {
+ 	NL80211_RADAR_DETECTED,
+@@ -6302,6 +6306,8 @@ enum nl80211_radar_event {
+ 	NL80211_RADAR_NOP_FINISHED,
+ 	NL80211_RADAR_PRE_CAC_EXPIRED,
+ 	NL80211_RADAR_CAC_STARTED,
++	NL80211_RADAR_STA_CAC_SKIPPED,
++	NL80211_RADAR_STA_CAC_EXPIRED,
+ };
+ 
+ /**
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 8ee325a..48053e4 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1442,6 +1442,10 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+ 					  IEEE80211_QUEUE_STOP_REASON_CSA);
+ 	mutex_unlock(&local->mtx);
+ 
++	cfg80211_sta_update_dfs_state(&sdata->wdev,
++				      &sdata->vif.bss_conf.chandef,
++				      &sdata->csa_chandef,
++				      sdata->vif.bss_conf.assoc);
+ 	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
+ 					  csa_ie.count, csa_ie.mode);
+ 
+@@ -2420,6 +2424,10 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
+ 	cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);
+ 
+ 	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
++
++	cfg80211_sta_update_dfs_state(&sdata->wdev,
++				      &sdata->vif.bss_conf.chandef,
++				      NULL, sdata->vif.bss_conf.assoc);
+ }
+ 
+ static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
+@@ -3782,6 +3790,9 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
+ 		event.u.mlme.status = MLME_SUCCESS;
+ 		drv_event_callback(sdata->local, sdata, &event);
+ 		sdata_info(sdata, "associated\n");
++		cfg80211_sta_update_dfs_state(&sdata->wdev,
++					      &sdata->vif.bss_conf.chandef,
++					      NULL, sdata->vif.bss_conf.assoc);
+ 
+ 		/*
+ 		 * destroy assoc_data afterwards, as otherwise an idle
+diff --git a/net/wireless/chan.c b/net/wireless/chan.c
+index 5f50ac4..0309758 100644
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -14,6 +14,7 @@
+ #include <net/cfg80211.h>
+ #include "core.h"
+ #include "rdev-ops.h"
++#include "nl80211.h"
+ 
+ static bool cfg80211_valid_60g_freq(u32 freq)
+ {
+@@ -1386,3 +1387,62 @@ bool cfg80211_any_usable_channels(struct wiphy *wiphy,
+ 	return false;
+ }
+ EXPORT_SYMBOL(cfg80211_any_usable_channels);
++
++static void cfg80211_sta_radar_notify(struct wiphy *wiphy,
++				      const struct cfg80211_chan_def *chandef,
++				      enum nl80211_radar_event event)
++{
++	struct wireless_dev *wdev;
++
++	list_for_each_entry(wdev, &wiphy->wdev_list, list) {
++		if (cfg80211_chandef_dfs_required(wiphy, chandef, wdev->iftype) > 0) {
++			nl80211_radar_notify(wiphy_to_rdev(wiphy), chandef,
++					     event, wdev->netdev, GFP_KERNEL);
++			return;
++		}
++	}
++}
++
++void cfg80211_sta_update_dfs_state(struct wireless_dev *wdev,
++				   const struct cfg80211_chan_def *bss_chandef,
++				   const struct cfg80211_chan_def *csa_chandef,
++				   bool associated)
++{
++	bool csa_active = !!csa_chandef;
++	enum nl80211_dfs_state dfs_state = NL80211_DFS_USABLE;
++	enum nl80211_radar_event event = NL80211_RADAR_STA_CAC_EXPIRED;
++
++	if (!bss_chandef)
++		return;
++
++	/* assume csa channel is cac completed */
++	if (csa_active &&
++	    (cfg80211_chandef_dfs_usable(wdev->wiphy, csa_chandef) ||
++	    cfg80211_chandef_dfs_available(wdev->wiphy, csa_chandef))) {
++		cfg80211_set_dfs_state(wdev->wiphy, csa_chandef, NL80211_DFS_AVAILABLE);
++		cfg80211_sta_radar_notify(wdev->wiphy, csa_chandef,
++					  NL80211_RADAR_STA_CAC_SKIPPED);
++		netdev_info(wdev->netdev, "Set CSA channel's DFS state to available\n");
++	}
++
++	/* avoid updating the dfs state during nop */
++	if (!cfg80211_chandef_dfs_usable(wdev->wiphy, bss_chandef) &&
++	    !cfg80211_chandef_dfs_available(wdev->wiphy, bss_chandef))
++		return;
++
++	if (associated && !csa_active) {
++		dfs_state = NL80211_DFS_AVAILABLE;
++		event = NL80211_RADAR_STA_CAC_SKIPPED;
++	}
++
++	cfg80211_set_dfs_state(wdev->wiphy, bss_chandef, dfs_state);
++	cfg80211_sta_radar_notify(wdev->wiphy, bss_chandef, event);
++
++	if (csa_active)
++		netdev_info(wdev->netdev, "Set origin channel's DFS state to usable\n");
++	else
++		netdev_info(wdev->netdev, "Set BSS channel's DFS state to %s due to %s\n",
++			    (dfs_state == NL80211_DFS_USABLE) ? "usable" : "available",
++			    associated ? "association" : "disassociation");
++}
++EXPORT_SYMBOL(cfg80211_sta_update_dfs_state);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
index 86e3ccb..ae088f6 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
@@ -60,9 +60,9 @@
     file://mtk-0009-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch \
     file://mtk-0010-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch \
     file://mtk-0011-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch \
-    file://mtk-0012-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch \
-    file://mtk-0013-mac80211-mtk-check-the-control-channel-before-downgr.patch \
-    file://mtk-0014-mac80211-mtk-fix-tx-amsdu-aggregation.patch \
+    file://mtk-0012-mac80211-mtk-check-the-control-channel-before-downgr.patch \
+    file://mtk-0013-mac80211-mtk-fix-tx-amsdu-aggregation.patch \
+    file://mtk-0014-mac80211-mtk-add-sta-assisted-DFS-state-update-mecha.patch \
     file://mtk-9900-mac80211-mtk-mask-kernel-version-limitation-and-fil.patch \
     file://mtk-9901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch \
     file://mtk-9902-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi2.patch \
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7981_rom_patch.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_rom_patch.bin
new file mode 100644
index 0000000..ae02f94
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_rom_patch.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wa.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wa.bin
new file mode 100644
index 0000000..5178123
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wa.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wm.bin
new file mode 100644
index 0000000..f0010ca
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wm.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wo.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wo.bin
new file mode 100644
index 0000000..aaf9865
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wo.bin
Binary files differ
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
deleted file mode 100644
index 3237aa3..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
+++ /dev/null
@@ -1,376 +0,0 @@
-From 4e7c861c971ca49ea162bd908fef6021a62b9018 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Fri, 7 Oct 2022 10:46:29 +0800
-Subject: [PATCH 10/15] hostapd: mtk: Add DFS and ZWDFS support
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- hostapd/config_file.c        |  4 ++
- hostapd/ctrl_iface.c         | 95 ++++++++++++++++++++++++++++++++++++
- src/ap/ap_config.h           | 13 +++++
- src/ap/dfs.c                 | 35 +++++++------
- src/ap/dfs.h                 | 15 ++++++
- src/ap/hostapd.c             |  4 +-
- src/drivers/driver.h         |  7 +++
- src/drivers/driver_nl80211.c | 29 +++++++++++
- src/drivers/nl80211_copy.h   |  1 +
- 9 files changed, 186 insertions(+), 17 deletions(-)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 63c9d40be..cd1534952 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -4803,6 +4803,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
- 		int val = atoi(pos);
- 		conf->ibf_enable = !!val;
-+	} else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
-+		u8 en = strtol(pos, NULL, 10);
-+
-+		conf->dfs_detect_mode = en;
- 	} else {
- 		wpa_printf(MSG_ERROR,
- 			   "Line %d: unknown configuration item '%s'",
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index c881d3717..6ea1573b8 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -3522,6 +3522,96 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
- }
- 
- 
-+static int
-+hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
-+				       char *buf, size_t buflen)
-+{
-+	u8 dfs_detect_mode;
-+
-+	if (!value)
-+		return -1;
-+
-+	dfs_detect_mode = strtol(value, NULL, 10);
-+	if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
-+		wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
-+		return -1;
-+	}
-+	hapd->iconf->dfs_detect_mode = dfs_detect_mode;
-+
-+	return os_snprintf(buf, buflen, "OK\n");
-+}
-+
-+
-+static int
-+hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
-+				    char *buf, size_t buflen)
-+{
-+	struct hostapd_iface *iface = hapd->iface;
-+	char *pos, *param;
-+	enum hostapd_hw_mode hw_mode;
-+	bool chan_found = false;
-+	int i, num_available_chandefs, channel, chan_width, sec = 0;
-+	int sec_chan_idx_80p80 = -1;
-+	u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
-+	struct hostapd_channel_data *chan;
-+	enum dfs_channel_type type = DFS_NO_CAC_YET;
-+
-+	param = os_strchr(cmd, ' ');
-+	if (!param)
-+		return -1;
-+	*param++ = '\0';
-+
-+	pos = os_strstr(param, "chan=");
-+	if (pos)
-+		channel = strtol(pos + 5, NULL, 10);
-+	else
-+		return -1;
-+
-+	num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
-+	for (i = 0; i < num_available_chandefs; i++) {
-+		dfs_find_channel(iface, &chan, i, type);
-+		if (chan->chan == channel) {
-+			chan_found = true;
-+			break;
-+		}
-+	}
-+
-+	if (!chan_found)
-+		return -1;
-+
-+	if (iface->conf->secondary_channel)
-+		sec = 1;
-+
-+	dfs_adjust_center_freq(iface, chan,
-+			       sec,
-+			       sec_chan_idx_80p80,
-+			       &oper_centr_freq_seg0_idx,
-+			       &oper_centr_freq_seg1_idx);
-+
-+	if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
-+				  chan->freq, chan->chan,
-+				  iface->conf->ieee80211n,
-+				  iface->conf->ieee80211ac,
-+				  iface->conf->ieee80211ax,
-+				  iface->conf->ieee80211be,
-+				  sec, hostapd_get_oper_chwidth(iface->conf),
-+				  oper_centr_freq_seg0_idx,
-+				  oper_centr_freq_seg1_idx, true)) {
-+		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
-+		iface->radar_background.channel = -1;
-+		return -1;
-+	}
-+
-+	iface->radar_background.channel = chan->chan;
-+	iface->radar_background.freq = chan->freq;
-+	iface->radar_background.secondary_channel = sec;
-+	iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
-+	iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
-+
-+	return os_snprintf(buf, buflen, "OK\n");
-+}
-+
-+
- static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 					      char *buf, char *reply,
- 					      int reply_size,
-@@ -4081,6 +4171,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 		reply_len = hostapd_ctrl_iface_get_mu(hapd, reply, reply_size);
- 	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
- 		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
-+	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
-+		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
-+								   reply, reply_size);
-+	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
-+		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
- 	} else {
- 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
- 		reply_len = 16;
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9e3d2aeb..77f6169d2 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -1160,6 +1160,7 @@ struct hostapd_config {
- 	int *edcca_threshold;
- 	u8 three_wire_enable;
- 	u8 ibf_enable;
-+	u8 dfs_detect_mode;
- };
- 
- enum three_wire_mode {
-@@ -1174,6 +1175,18 @@ enum three_wire_mode {
- 		NUM_THREE_WIRE_MODE - 1
- };
- 
-+enum dfs_mode {
-+	DFS_DETECT_MODE_DISABLE,
-+	DFS_DETECT_MODE_AP_ENABLE,
-+	DFS_DETECT_MODE_BACKGROUND_ENABLE,
-+	DFS_DETECT_MODE_ALL_ENABLE,
-+
-+	/* keep last */
-+	NUM_DFS_DETECT_MODE,
-+	DFS_DETECT_MODE_MAX =
-+		NUM_DFS_DETECT_MODE - 1
-+};
-+
- enum edcca_mode {
- 	EDCCA_MODE_FORCE_DISABLE = 0,
- 	EDCCA_MODE_AUTO = 1,
-diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index b5d105d6a..1c3f6785b 100644
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -19,13 +19,6 @@
- #include "dfs.h"
- #include "crypto/crypto.h"
- 
--
--enum dfs_channel_type {
--	DFS_ANY_CHANNEL,
--	DFS_AVAILABLE, /* non-radar or radar-available */
--	DFS_NO_CAC_YET, /* radar-not-yet-available */
--};
--
- static struct hostapd_channel_data *
- dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
- 			u8 *oper_centr_freq_seg0_idx,
-@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
-  *  - hapd->vht/he_oper_centr_freq_seg0_idx
-  *  - hapd->vht/he_oper_centr_freq_seg1_idx
-  */
--static int dfs_find_channel(struct hostapd_iface *iface,
--			    struct hostapd_channel_data **ret_chan,
--			    int idx, enum dfs_channel_type type)
-+int dfs_find_channel(struct hostapd_iface *iface,
-+		     struct hostapd_channel_data **ret_chan,
-+		     int idx, enum dfs_channel_type type)
- {
- 	struct hostapd_hw_modes *mode;
- 	struct hostapd_channel_data *chan;
-@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
- }
- 
- 
--static void dfs_adjust_center_freq(struct hostapd_iface *iface,
--				   struct hostapd_channel_data *chan,
--				   int secondary_channel,
--				   int sec_chan_idx_80p80,
--				   u8 *oper_centr_freq_seg0_idx,
--				   u8 *oper_centr_freq_seg1_idx)
-+void dfs_adjust_center_freq(struct hostapd_iface *iface,
-+			    struct hostapd_channel_data *chan,
-+			    int secondary_channel,
-+			    int sec_chan_idx_80p80,
-+			    u8 *oper_centr_freq_seg0_idx,
-+			    u8 *oper_centr_freq_seg1_idx)
- {
- 	if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
- 		return;
-@@ -1317,6 +1310,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
- 		   __func__, iface->radar_background.cac_started ? "yes" : "no",
- 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
- 
-+	/* Skip channel switch when background dfs detect mode is on */
-+	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
-+	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
-+		return 0;
-+
- 	/* Check if CSA in progress */
- 	if (hostapd_csa_in_progress(iface))
- 		return 0;
-@@ -1365,6 +1363,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
- 		   __func__, iface->cac_started ? "yes" : "no",
- 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
- 
-+	/* Skip channel switch when dfs detect mode is on */
-+	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
-+	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
-+		return 0;
-+
- 	/* Check if CSA in progress */
- 	if (hostapd_csa_in_progress(iface))
- 		return 0;
-diff --git a/src/ap/dfs.h b/src/ap/dfs.h
-index 606c1b393..c2556d2d9 100644
---- a/src/ap/dfs.h
-+++ b/src/ap/dfs.h
-@@ -9,6 +9,12 @@
- #ifndef DFS_H
- #define DFS_H
- 
-+enum dfs_channel_type {
-+	DFS_ANY_CHANNEL,
-+	DFS_AVAILABLE, /* non-radar or radar-available */
-+	DFS_NO_CAC_YET, /* radar-not-yet-available */
-+};
-+
- int hostapd_handle_dfs(struct hostapd_iface *iface);
- 
- int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
-@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
- int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
- int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
- 			   int center_freq);
-+int dfs_find_channel(struct hostapd_iface *iface,
-+		     struct hostapd_channel_data **ret_chan,
-+		     int idx, enum dfs_channel_type type);
-+void dfs_adjust_center_freq(struct hostapd_iface *iface,
-+			    struct hostapd_channel_data *chan,
-+			    int secondary_channel,
-+			    int sec_chan_idx_80p80,
-+			    u8 *oper_centr_freq_seg0_idx,
-+			    u8 *oper_centr_freq_seg1_idx);
- 
- #endif /* DFS_H */
-diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index da7f7d87b..a0229c9ca 100644
---- a/src/ap/hostapd.c
-+++ b/src/ap/hostapd.c
-@@ -1464,7 +1464,9 @@ static int hostapd_setup_bss(struct hostapd_data *hapd, int first)
- 		return -1;
- 	}
- 
--	if (!conf->start_disabled && ieee802_11_set_beacon(hapd) < 0)
-+	if (conf->start_disabled)
-+		hapd->driver->start_disabled(hapd->drv_priv);
-+	else if (ieee802_11_set_beacon(hapd) < 0)
- 		return -1;
- 
- 	if (flush_old_stations && !conf->start_disabled &&
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 71ded617f..aa23fbdb3 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -4720,6 +4720,13 @@ struct wpa_driver_ops {
- 	 *
- 	 */
- 	int (*ibf_dump)(void *priv, u8 *ibf_enable);
-+
-+	/**
-+	 * start_disabled - set start_disabled to cfg80211
-+	 * @priv: Private driver interface data
-+	 *
-+	 */
-+	int (*start_disabled)(void *priv);
- };
- 
- /**
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 5c2a291ca..7472542cc 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -12776,6 +12776,34 @@ fail:
- 	return -ENOBUFS;
- }
- 
-+static int nl80211_start_disabled(void *priv)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_NEW_BEACON);
-+	if (!msg)
-+		goto fail;
-+
-+	if (nla_put_flag(msg, NL80211_ATTR_START_DISABLED))
-+		goto fail;
-+
-+	ret = send_and_recv_msgs_connect_handle(drv, msg, bss, 1);
-+
-+	if (ret)
-+		wpa_printf(MSG_ERROR, "Failed to set start_disabled. ret=%d (%s)",
-+			   ret, strerror(-ret));
-+
-+	return ret;
-+
-+fail:
-+	nlmsg_free(msg);
-+	return ret;
-+}
-+
- const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.name = "nl80211",
- 	.desc = "Linux nl80211/cfg80211",
-@@ -12930,4 +12958,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.three_wire_ctrl = nl80211_enable_three_wire,
- 	.ibf_ctrl = nl80211_ibf_enable,
- 	.ibf_dump = nl80211_ibf_dump,
-+	.start_disabled = nl80211_start_disabled,
- };
-diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index c4bf3ad35..79bc76c57 100644
---- a/src/drivers/nl80211_copy.h
-+++ b/src/drivers/nl80211_copy.h
-@@ -3176,6 +3176,7 @@ enum nl80211_attrs {
- 	NL80211_ATTR_EHT_CAPABILITY,
- 
- 	/* add attributes here, update the policy in nl80211.c */
-+	NL80211_ATTR_START_DISABLED = 999,
- 
- 	__NL80211_ATTR_AFTER_LAST,
- 	NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
--- 
-2.25.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
new file mode 100644
index 0000000..2ceb639
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
@@ -0,0 +1,136 @@
+From 6828156c206701f5a0e5d30afcc514f452ce0ada Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 14:55:49 +0800
+Subject: [PATCH 10/16] hostapd: mtk: Add DFS detection mode
+
+Add DFS detection mode for testing radar detection rate.
+If DFS detection mode is on, AP will not switch channels when receiving
+a radar signal.
+This detection mode also supports background chain.
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c |  4 ++++
+ hostapd/ctrl_iface.c  | 23 +++++++++++++++++++++++
+ src/ap/ap_config.h    | 13 +++++++++++++
+ src/ap/dfs.c          | 10 ++++++++++
+ 4 files changed, 50 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 63c9d40..cd15349 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4803,6 +4803,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
+ 		int val = atoi(pos);
+ 		conf->ibf_enable = !!val;
++	} else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
++		u8 en = strtol(pos, NULL, 10);
++
++		conf->dfs_detect_mode = en;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c881d37..0b4c234 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3522,6 +3522,26 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
++				       char *buf, size_t buflen)
++{
++	u8 dfs_detect_mode;
++
++	if (!value)
++		return -1;
++
++	dfs_detect_mode = strtol(value, NULL, 10);
++	if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
++		wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
++		return -1;
++	}
++	hapd->iconf->dfs_detect_mode = dfs_detect_mode;
++
++	return os_snprintf(buf, buflen, "OK\n");
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4081,6 +4101,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ 	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
+ 		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
++	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
++		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
++								   reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index a9e3d2a..77f6169 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1160,6 +1160,7 @@ struct hostapd_config {
+ 	int *edcca_threshold;
+ 	u8 three_wire_enable;
+ 	u8 ibf_enable;
++	u8 dfs_detect_mode;
+ };
+ 
+ enum three_wire_mode {
+@@ -1174,6 +1175,18 @@ enum three_wire_mode {
+ 		NUM_THREE_WIRE_MODE - 1
+ };
+ 
++enum dfs_mode {
++	DFS_DETECT_MODE_DISABLE,
++	DFS_DETECT_MODE_AP_ENABLE,
++	DFS_DETECT_MODE_BACKGROUND_ENABLE,
++	DFS_DETECT_MODE_ALL_ENABLE,
++
++	/* keep last */
++	NUM_DFS_DETECT_MODE,
++	DFS_DETECT_MODE_MAX =
++		NUM_DFS_DETECT_MODE - 1
++};
++
+ enum edcca_mode {
+ 	EDCCA_MODE_FORCE_DISABLE = 0,
+ 	EDCCA_MODE_AUTO = 1,
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index b5d105d..5cb7799 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1317,6 +1317,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ 		   __func__, iface->radar_background.cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when background dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+@@ -1365,6 +1370,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
+ 		   __func__, iface->cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
new file mode 100644
index 0000000..1d8baf8
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
@@ -0,0 +1,192 @@
+From 88dd3df28e3736af4cca0daf4f7d19ab888ea6c4 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 14:56:55 +0800
+Subject: [PATCH 11/16] hostapd: mtk: Add DFS offchan channel switch
+
+Add DFS background chain channel switch command for testing purpose.
+This feature is implemented via hostapd_cli command.
+Command format:
+hostapd_cli -i <interface> raw SET_OFFCHAN_CTRL chan=<dfs_channel>
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 72 ++++++++++++++++++++++++++++++++++++++++++++
+ src/ap/dfs.c         | 25 ++++++---------
+ src/ap/dfs.h         | 15 +++++++++
+ 3 files changed, 96 insertions(+), 16 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 0b4c234..6ea1573 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3542,6 +3542,76 @@ hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
++				    char *buf, size_t buflen)
++{
++	struct hostapd_iface *iface = hapd->iface;
++	char *pos, *param;
++	enum hostapd_hw_mode hw_mode;
++	bool chan_found = false;
++	int i, num_available_chandefs, channel, chan_width, sec = 0;
++	int sec_chan_idx_80p80 = -1;
++	u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
++	struct hostapd_channel_data *chan;
++	enum dfs_channel_type type = DFS_NO_CAC_YET;
++
++	param = os_strchr(cmd, ' ');
++	if (!param)
++		return -1;
++	*param++ = '\0';
++
++	pos = os_strstr(param, "chan=");
++	if (pos)
++		channel = strtol(pos + 5, NULL, 10);
++	else
++		return -1;
++
++	num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
++	for (i = 0; i < num_available_chandefs; i++) {
++		dfs_find_channel(iface, &chan, i, type);
++		if (chan->chan == channel) {
++			chan_found = true;
++			break;
++		}
++	}
++
++	if (!chan_found)
++		return -1;
++
++	if (iface->conf->secondary_channel)
++		sec = 1;
++
++	dfs_adjust_center_freq(iface, chan,
++			       sec,
++			       sec_chan_idx_80p80,
++			       &oper_centr_freq_seg0_idx,
++			       &oper_centr_freq_seg1_idx);
++
++	if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
++				  chan->freq, chan->chan,
++				  iface->conf->ieee80211n,
++				  iface->conf->ieee80211ac,
++				  iface->conf->ieee80211ax,
++				  iface->conf->ieee80211be,
++				  sec, hostapd_get_oper_chwidth(iface->conf),
++				  oper_centr_freq_seg0_idx,
++				  oper_centr_freq_seg1_idx, true)) {
++		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
++		iface->radar_background.channel = -1;
++		return -1;
++	}
++
++	iface->radar_background.channel = chan->chan;
++	iface->radar_background.freq = chan->freq;
++	iface->radar_background.secondary_channel = sec;
++	iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
++	iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
++
++	return os_snprintf(buf, buflen, "OK\n");
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4104,6 +4174,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
+ 		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
+ 								   reply, reply_size);
++	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
++		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 5cb7799..1c3f678 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -19,13 +19,6 @@
+ #include "dfs.h"
+ #include "crypto/crypto.h"
+ 
+-
+-enum dfs_channel_type {
+-	DFS_ANY_CHANNEL,
+-	DFS_AVAILABLE, /* non-radar or radar-available */
+-	DFS_NO_CAC_YET, /* radar-not-yet-available */
+-};
+-
+ static struct hostapd_channel_data *
+ dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
+ 			u8 *oper_centr_freq_seg0_idx,
+@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
+  *  - hapd->vht/he_oper_centr_freq_seg0_idx
+  *  - hapd->vht/he_oper_centr_freq_seg1_idx
+  */
+-static int dfs_find_channel(struct hostapd_iface *iface,
+-			    struct hostapd_channel_data **ret_chan,
+-			    int idx, enum dfs_channel_type type)
++int dfs_find_channel(struct hostapd_iface *iface,
++		     struct hostapd_channel_data **ret_chan,
++		     int idx, enum dfs_channel_type type)
+ {
+ 	struct hostapd_hw_modes *mode;
+ 	struct hostapd_channel_data *chan;
+@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
+ }
+ 
+ 
+-static void dfs_adjust_center_freq(struct hostapd_iface *iface,
+-				   struct hostapd_channel_data *chan,
+-				   int secondary_channel,
+-				   int sec_chan_idx_80p80,
+-				   u8 *oper_centr_freq_seg0_idx,
+-				   u8 *oper_centr_freq_seg1_idx)
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++			    struct hostapd_channel_data *chan,
++			    int secondary_channel,
++			    int sec_chan_idx_80p80,
++			    u8 *oper_centr_freq_seg0_idx,
++			    u8 *oper_centr_freq_seg1_idx)
+ {
+ 	if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
+ 		return;
+diff --git a/src/ap/dfs.h b/src/ap/dfs.h
+index 606c1b3..c2556d2 100644
+--- a/src/ap/dfs.h
++++ b/src/ap/dfs.h
+@@ -9,6 +9,12 @@
+ #ifndef DFS_H
+ #define DFS_H
+ 
++enum dfs_channel_type {
++	DFS_ANY_CHANNEL,
++	DFS_AVAILABLE, /* non-radar or radar-available */
++	DFS_NO_CAC_YET, /* radar-not-yet-available */
++};
++
+ int hostapd_handle_dfs(struct hostapd_iface *iface);
+ 
+ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+ int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
+ int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
+ 			   int center_freq);
++int dfs_find_channel(struct hostapd_iface *iface,
++		     struct hostapd_channel_data **ret_chan,
++		     int idx, enum dfs_channel_type type);
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++			    struct hostapd_channel_data *chan,
++			    int secondary_channel,
++			    int sec_chan_idx_80p80,
++			    u8 *oper_centr_freq_seg0_idx,
++			    u8 *oper_centr_freq_seg1_idx);
+ 
+ #endif /* DFS_H */
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
deleted file mode 100644
index dba90d1..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
+++ /dev/null
@@ -1,400 +0,0 @@
-From bc0722ebc1cc08be6239879fddaef37e0db2d9e0 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Fri, 16 Dec 2022 03:57:11 +0800
-Subject: [PATCH 11/15] hostapd: mtk: Add amsdu set get ctrl
-
----
- hostapd/config_file.c             |   9 +++
- hostapd/ctrl_iface.c              |  26 +++++++
- hostapd/hostapd_cli.c             |   9 +++
- src/ap/ap_config.c                |   1 +
- src/ap/ap_config.h                |   1 +
- src/ap/ap_drv_ops.c               |  14 ++++
- src/ap/ap_drv_ops.h               |   2 +
- src/ap/hostapd.c                  |   2 +
- src/common/mtk_vendor.h           |  17 ++++-
- src/drivers/driver.h              |   9 +++
- src/drivers/driver_nl80211.c      | 114 ++++++++++++++++++++++++++++++
- src/drivers/driver_nl80211.h      |   1 +
- src/drivers/driver_nl80211_capa.c |   3 +
- 13 files changed, 207 insertions(+), 1 deletion(-)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd1534952..10ea52518 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -4807,6 +4807,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 		u8 en = strtol(pos, NULL, 10);
- 
- 		conf->dfs_detect_mode = en;
-+	} else if (os_strcmp(buf, "amsdu") == 0) {
-+		int val = atoi(pos);
-+		if (val < 0 || val > 1) {
-+			wpa_printf(MSG_ERROR,
-+					 "Line %d: invalid amsdu value",
-+					 line);
-+			return 1;
-+		}
-+		conf->amsdu = val;
- 	} else {
- 		wpa_printf(MSG_ERROR,
- 			   "Line %d: unknown configuration item '%s'",
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 6ea1573b8..0ad8451aa 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -3612,6 +3612,30 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
- }
- 
- 
-+static int
-+hostapd_ctrl_iface_get_amsdu(struct hostapd_data *hapd, char *buf,
-+					 size_t buflen)
-+{
-+	u8 amsdu;
-+	int ret;
-+	char *pos, *end;
-+
-+	pos = buf;
-+	end = buf + buflen;
-+
-+	if (hostapd_drv_amsdu_dump(hapd, &amsdu) == 0) {
-+		hapd->iconf->amsdu = amsdu;
-+		ret = os_snprintf(pos, end - pos, "[hostapd_cli] AMSDU: %u\n",
-+					hapd->iconf->amsdu);
-+	}
-+
-+	if (os_snprintf_error(end - pos, ret))
-+		return 0;
-+
-+	return ret;
-+}
-+
-+
- static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 					      char *buf, char *reply,
- 					      int reply_size,
-@@ -4176,6 +4200,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 								   reply, reply_size);
- 	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
- 		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
-+	} else if (os_strncmp(buf, "GET_AMSDU", 9) == 0) {
-+		reply_len = hostapd_ctrl_iface_get_amsdu(hapd, reply, reply_size);
- 	} else {
- 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
- 		reply_len = 16;
-diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index c2a123a8c..30b3392e6 100644
---- a/hostapd/hostapd_cli.c
-+++ b/hostapd/hostapd_cli.c
-@@ -1593,6 +1593,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
- }
- 
- 
-+static int hostapd_cli_cmd_get_amsdu(struct wpa_ctrl *ctrl, int argc,
-+					   char *argv[])
-+{
-+	return hostapd_cli_cmd(ctrl, "GET_AMSDU", 0, NULL, NULL);
-+}
-+
-+
- struct hostapd_cli_cmd {
- 	const char *cmd;
- 	int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
-@@ -1796,6 +1803,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
-           "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
- 	{ "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
- 	  " = show iBF state (enabled/disabled)"},
-+	{ "get_amsdu", hostapd_cli_cmd_get_amsdu, NULL,
-+		" = show AMSDU state"},
- 	{ NULL, NULL, NULL, NULL }
- };
- 
-diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 7a96cb8b2..85ad5e444 100644
---- a/src/ap/ap_config.c
-+++ b/src/ap/ap_config.c
-@@ -299,6 +299,7 @@ struct hostapd_config * hostapd_config_defaults(void)
- 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
- 	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
- 	conf->ibf_enable = IBF_DEFAULT_ENABLE;
-+	conf->amsdu = 1;
- 
- 	return conf;
- }
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 77f6169d2..a9ac39619 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -1161,6 +1161,7 @@ struct hostapd_config {
- 	u8 three_wire_enable;
- 	u8 ibf_enable;
- 	u8 dfs_detect_mode;
-+	u8 amsdu;
- };
- 
- enum three_wire_mode {
-diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 60ae8253b..1a82f234c 100644
---- a/src/ap/ap_drv_ops.c
-+++ b/src/ap/ap_drv_ops.c
-@@ -1077,4 +1077,18 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
- 	if (!hapd->driver || !hapd->driver->ibf_dump)
- 		return 0;
- 	return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
-+}
-+
-+int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd)
-+{
-+	if (!hapd->driver || !hapd->driver->amsdu_ctrl)
-+		return 0;
-+	return hapd->driver->amsdu_ctrl(hapd->drv_priv, hapd->iconf->amsdu);
-+}
-+
-+int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu)
-+{
-+	if (!hapd->driver || !hapd->driver->amsdu_dump)
-+		return 0;
-+	return hapd->driver->amsdu_dump(hapd->drv_priv, amsdu);
- }
-\ No newline at end of file
-diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index ab9aedcee..4406666fd 100644
---- a/src/ap/ap_drv_ops.h
-+++ b/src/ap/ap_drv_ops.h
-@@ -147,6 +147,8 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff);
- int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
- int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
- int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
-+int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd);
-+int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu);
- 
- #include "drivers/driver.h"
- 
-diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index a0229c9ca..152060db4 100644
---- a/src/ap/hostapd.c
-+++ b/src/ap/hostapd.c
-@@ -2310,6 +2310,8 @@ dfs_offload:
- 		goto fail;
- 	if (hostapd_drv_ibf_ctrl(hapd) < 0)
- 		goto fail;
-+	if (hostapd_drv_amsdu_ctrl(hapd) < 0)
-+		goto fail;
- 
- 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
- 		   iface->bss[0]->conf->iface);
-diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 4050cf886..0999ea9e2 100644
---- a/src/common/mtk_vendor.h
-+++ b/src/common/mtk_vendor.h
-@@ -167,7 +167,6 @@ enum mtk_vendor_attr_wireless_ctrl {
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
--	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
- 
-@@ -177,6 +176,22 @@ enum mtk_vendor_attr_wireless_ctrl {
- 		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
- };
- 
-+enum mtk_vendor_attr_wireless_dump {
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP,
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX =
-+		NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP - 1
-+};
-+
-+static const struct nla_policy
-+wireless_dump_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP] = {
-+	[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU] = { .type = NLA_U8 },
-+};
-+
- enum mtk_vendor_attr_rfeature_ctrl {
- 	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
- 
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index aa23fbdb3..b07aaf3fe 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -4727,6 +4727,15 @@ struct wpa_driver_ops {
- 	 *
- 	 */
- 	int (*start_disabled)(void *priv);
-+
-+	/**
-+	 * amsdu_ctrl - enable/disable amsdu
-+	 * amsdu_dump - get current amsdu status
-+	 * @priv: Private driver interface data
-+	 *
-+	 */
-+	int (*amsdu_ctrl)(void *priv, u8 amsdu);
-+	int (*amsdu_dump)(void *priv, u8 *amsdu);
- };
- 
- /**
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 7472542cc..6702384ef 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -12804,6 +12804,118 @@ fail:
- 	return ret;
- }
- 
-+static int nl80211_enable_amsdu(void *priv, u8 amsdu)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	if (!drv->mtk_wireless_vendor_cmd_avail) {
-+		wpa_printf(MSG_INFO,
-+			   "nl80211: Driver does not support setting ap wireless control");
-+		return 0;
-+	}
-+
-+	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
-+	if (!msg)
-+		goto fail;
-+
-+	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
-+		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
-+		goto fail;
-+
-+	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
-+	if (!data)
-+		goto fail;
-+
-+	nla_put_u8(msg, MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU, amsdu);
-+
-+	nla_nest_end(msg, data);
-+	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
-+	if (ret) {
-+		wpa_printf(MSG_ERROR, "Failed to set amsdu. ret=%d (%s)", ret, strerror(-ret));
-+	}
-+
-+	return ret;
-+
-+fail:
-+	nlmsg_free(msg);
-+	return -ENOBUFS;
-+}
-+
-+static int dump_amsdu_handler(struct nl_msg *msg, void *arg)
-+{
-+	u8 *amsdu = (u8 *) arg;
-+	struct nlattr *tb[NL80211_ATTR_MAX + 1];
-+	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX + 1];
-+	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
-+	struct nlattr *nl_vend, *attr_amsdu;
-+
-+	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
-+			genlmsg_attrlen(gnlh, 0), NULL);
-+
-+	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
-+	if (!nl_vend)
-+		return NL_SKIP;
-+
-+	nla_parse(tb_vendor, MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX,
-+			nla_data(nl_vend), nla_len(nl_vend), NULL);
-+
-+	attr_amsdu = tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU];
-+	if (!attr_amsdu ){
-+		wpa_printf(MSG_ERROR, "nl80211: cannot find vendor attributes");
-+		return NL_SKIP;
-+	}
-+
-+	*amsdu = nla_get_u8(attr_amsdu);
-+
-+	return NL_SKIP;
-+}
-+
-+static int
-+nl80211_dump_amsdu(void *priv, u8 *amsdu)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	if (!drv->mtk_wireless_vendor_cmd_avail) {
-+		wpa_printf(MSG_INFO,
-+				 "nl80211: Driver does not support ap_wireless control");
-+		return 0;
-+	}
-+
-+	msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
-+	if (!msg)
-+		goto fail;
-+
-+	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
-+		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
-+		goto fail;
-+
-+	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
-+	if (!data)
-+		goto fail;
-+
-+	nla_nest_end(msg, data);
-+
-+	ret = send_and_recv_msgs(drv, msg, dump_amsdu_handler, amsdu, NULL, NULL);
-+
-+	if (ret) {
-+		wpa_printf(MSG_ERROR, "Failed to dump amsdu. ret=%d (%s)", ret, strerror(-ret));
-+	}
-+
-+	return ret;
-+
-+fail:
-+	nlmsg_free(msg);
-+	return -ENOBUFS;
-+}
-+
- const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.name = "nl80211",
- 	.desc = "Linux nl80211/cfg80211",
-@@ -12959,4 +13071,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.ibf_ctrl = nl80211_ibf_enable,
- 	.ibf_dump = nl80211_ibf_dump,
- 	.start_disabled = nl80211_start_disabled,
-+	.amsdu_ctrl = nl80211_enable_amsdu,
-+	.amsdu_dump = nl80211_dump_amsdu,
- };
-diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 607592ceb..e57022409 100644
---- a/src/drivers/driver_nl80211.h
-+++ b/src/drivers/driver_nl80211.h
-@@ -185,6 +185,7 @@ struct wpa_driver_nl80211_data {
- 	unsigned int mtk_mu_vendor_cmd_avail:1;
- 	unsigned int mtk_3wire_vendor_cmd_avail:1;
- 	unsigned int mtk_ibf_vendor_cmd_avail:1;
-+	unsigned int mtk_wireless_vendor_cmd_avail:1;
- 
- 	u64 vendor_scan_cookie;
- 	u64 remain_on_chan_cookie;
-diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 9ecc0ff9a..fcfa68bf7 100644
---- a/src/drivers/driver_nl80211_capa.c
-+++ b/src/drivers/driver_nl80211_capa.c
-@@ -1065,6 +1065,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
- 				case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
- 					drv->mtk_ibf_vendor_cmd_avail = 1;
- 					break;
-+				case MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL:
-+					drv->mtk_wireless_vendor_cmd_avail = 1;
-+					break;
- 				}
- 			}
- 
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
similarity index 92%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
copy to recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
index dba90d1..7db3ae2 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
@@ -1,7 +1,7 @@
-From bc0722ebc1cc08be6239879fddaef37e0db2d9e0 Mon Sep 17 00:00:00 2001
+From d0128fc60d38ce4f20f8368bdc5ea9ed19a329b7 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 16 Dec 2022 03:57:11 +0800
-Subject: [PATCH 11/15] hostapd: mtk: Add amsdu set get ctrl
+Subject: [PATCH 12/16] hostapd: mtk: Add amsdu set get ctrl
 
 ---
  hostapd/config_file.c             |   9 +++
@@ -20,7 +20,7 @@
  13 files changed, 207 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd1534952..10ea52518 100644
+index cd15349..10ea525 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4807,6 +4807,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -40,7 +40,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 6ea1573b8..0ad8451aa 100644
+index 6ea1573..0ad8451 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3612,6 +3612,30 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
@@ -84,7 +84,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index c2a123a8c..30b3392e6 100644
+index c2a123a..30b3392 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1593,6 +1593,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
@@ -111,7 +111,7 @@
  };
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 7a96cb8b2..85ad5e444 100644
+index 7a96cb8..85ad5e4 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -299,6 +299,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -123,7 +123,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 77f6169d2..a9ac39619 100644
+index 77f6169..a9ac396 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1161,6 +1161,7 @@ struct hostapd_config {
@@ -135,7 +135,7 @@
  
  enum three_wire_mode {
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 60ae8253b..1a82f234c 100644
+index 60ae825..1a82f23 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1077,4 +1077,18 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
@@ -159,7 +159,7 @@
  }
 \ No newline at end of file
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index ab9aedcee..4406666fd 100644
+index ab9aedc..4406666 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -147,6 +147,8 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff);
@@ -172,10 +172,10 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index a0229c9ca..152060db4 100644
+index da7f7d8..a18e744 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -2310,6 +2310,8 @@ dfs_offload:
+@@ -2308,6 +2308,8 @@ dfs_offload:
  		goto fail;
  	if (hostapd_drv_ibf_ctrl(hapd) < 0)
  		goto fail;
@@ -185,7 +185,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 4050cf886..0999ea9e2 100644
+index 4050cf8..0999ea9 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -167,7 +167,6 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -220,13 +220,13 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index aa23fbdb3..b07aaf3fe 100644
+index 71ded61..265d86d 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -4727,6 +4727,15 @@ struct wpa_driver_ops {
+@@ -4720,6 +4720,15 @@ struct wpa_driver_ops {
  	 *
  	 */
- 	int (*start_disabled)(void *priv);
+ 	int (*ibf_dump)(void *priv, u8 *ibf_enable);
 +
 +	/**
 +	 * amsdu_ctrl - enable/disable amsdu
@@ -240,11 +240,11 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 7472542cc..6702384ef 100644
+index 5c2a291..d91b29c 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -12804,6 +12804,118 @@ fail:
- 	return ret;
+@@ -12776,6 +12776,118 @@ fail:
+ 	return -ENOBUFS;
  }
  
 +static int nl80211_enable_amsdu(void *priv, u8 amsdu)
@@ -362,15 +362,15 @@
  const struct wpa_driver_ops wpa_driver_nl80211_ops = {
  	.name = "nl80211",
  	.desc = "Linux nl80211/cfg80211",
-@@ -12959,4 +13071,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+@@ -12930,4 +13042,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.three_wire_ctrl = nl80211_enable_three_wire,
  	.ibf_ctrl = nl80211_ibf_enable,
  	.ibf_dump = nl80211_ibf_dump,
- 	.start_disabled = nl80211_start_disabled,
 +	.amsdu_ctrl = nl80211_enable_amsdu,
 +	.amsdu_dump = nl80211_dump_amsdu,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 607592ceb..e57022409 100644
+index 607592c..e570224 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -185,6 +185,7 @@ struct wpa_driver_nl80211_data {
@@ -382,7 +382,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 9ecc0ff9a..fcfa68bf7 100644
+index 9ecc0ff..fcfa68b 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1065,6 +1065,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -396,5 +396,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch
deleted file mode 100644
index 63101e0..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From b49ce922afa13fe8ea5d847753dfb7641b70c9a4 Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Thu, 12 Jan 2023 15:18:19 +0800
-Subject: [PATCH 12/15] hostapd: mtk: Add he_ldpc configuration
-
----
- hostapd/config_file.c        | 2 ++
- hostapd/hostapd.conf         | 5 +++++
- src/ap/ap_config.c           | 1 +
- src/ap/ap_config.h           | 1 +
- src/ap/ieee802_11_he.c       | 7 +++++++
- src/common/ieee802_11_defs.h | 3 +++
- 6 files changed, 19 insertions(+)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 10ea52518..4237a5cca 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -3508,6 +3508,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 		conf->he_phy_capab.he_su_beamformee = atoi(pos);
- 	} else if (os_strcmp(buf, "he_mu_beamformer") == 0) {
- 		conf->he_phy_capab.he_mu_beamformer = atoi(pos);
-+	} else if (os_strcmp(buf, "he_ldpc") == 0) {
-+		conf->he_phy_capab.he_ldpc = atoi(pos);
- 	} else if (os_strcmp(buf, "he_bss_color") == 0) {
- 		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
- 		conf->he_op.he_bss_color_disabled = 0;
-diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
-index ea67aa100..e3a5eb365 100644
---- a/hostapd/hostapd.conf
-+++ b/hostapd/hostapd.conf
-@@ -830,6 +830,11 @@ wmm_ac_vo_acm=0
- # 1 = supported
- #he_mu_beamformer=1
- 
-+#he_ldpc: HE LDPC support
-+# 0 = not supported
-+# 1 = supported (default)
-+#he_ldpc=1
-+
- # he_bss_color: BSS color (1-63)
- #he_bss_color=1
- 
-diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 85ad5e444..b283de624 100644
---- a/src/ap/ap_config.c
-+++ b/src/ap/ap_config.c
-@@ -268,6 +268,7 @@ struct hostapd_config * hostapd_config_defaults(void)
- #endif /* CONFIG_ACS */
- 
- #ifdef CONFIG_IEEE80211AX
-+	conf->he_phy_capab.he_ldpc = 1;
- 	conf->he_op.he_rts_threshold = HE_OPERATION_RTS_THRESHOLD_MASK >>
- 		HE_OPERATION_RTS_THRESHOLD_OFFSET;
- 	/* Set default basic MCS/NSS set to single stream MCS 0-7 */
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9ac39619..b8b20a7aa 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -929,6 +929,7 @@ struct hostapd_bss_config {
-  * struct he_phy_capabilities_info - HE PHY capabilities
-  */
- struct he_phy_capabilities_info {
-+	bool he_ldpc;
- 	bool he_su_beamformer;
- 	bool he_su_beamformee;
- 	bool he_mu_beamformer;
-diff --git a/src/ap/ieee802_11_he.c b/src/ap/ieee802_11_he.c
-index b5b7e5d46..f27aeb196 100644
---- a/src/ap/ieee802_11_he.c
-+++ b/src/ap/ieee802_11_he.c
-@@ -138,6 +138,13 @@ u8 * hostapd_eid_he_capab(struct hostapd_data *hapd, u8 *eid,
- 		os_memcpy(&cap->optional[mcs_nss_size],
- 			  mode->he_capab[opmode].ppet,  ppet_size);
- 
-+	if (hapd->iface->conf->he_phy_capab.he_ldpc)
-+		cap->he_phy_capab_info[HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX] |=
-+			HE_PHYCAP_LDPC_CODING_IN_PAYLOAD;
-+	else
-+		cap->he_phy_capab_info[HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX] &=
-+			~HE_PHYCAP_LDPC_CODING_IN_PAYLOAD;
-+
- 	if (hapd->iface->conf->he_phy_capab.he_su_beamformer)
- 		cap->he_phy_capab_info[HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX] |=
- 			HE_PHYCAP_SU_BEAMFORMER_CAPAB;
-diff --git a/src/common/ieee802_11_defs.h b/src/common/ieee802_11_defs.h
-index 65e125e83..62088bda6 100644
---- a/src/common/ieee802_11_defs.h
-+++ b/src/common/ieee802_11_defs.h
-@@ -2298,6 +2298,9 @@ struct ieee80211_spatial_reuse {
- #define HE_PHYCAP_CHANNEL_WIDTH_SET_160MHZ_IN_5G	((u8) BIT(3))
- #define HE_PHYCAP_CHANNEL_WIDTH_SET_80PLUS80MHZ_IN_5G	((u8) BIT(4))
- 
-+#define HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX	1
-+#define HE_PHYCAP_LDPC_CODING_IN_PAYLOAD	((u8) BIT(5))
-+
- #define HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX	3
- #define HE_PHYCAP_SU_BEAMFORMER_CAPAB		((u8) BIT(7))
- #define HE_PHYCAP_SU_BEAMFORMEE_CAPAB_IDX	4
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
similarity index 90%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch
copy to recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
index 63101e0..4df0ba6 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
@@ -1,7 +1,7 @@
-From b49ce922afa13fe8ea5d847753dfb7641b70c9a4 Mon Sep 17 00:00:00 2001
+From ebbf23ac8c19224b34523e8b9820e32f0789fe11 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 12 Jan 2023 15:18:19 +0800
-Subject: [PATCH 12/15] hostapd: mtk: Add he_ldpc configuration
+Subject: [PATCH 13/16] hostapd: mtk: Add he_ldpc configuration
 
 ---
  hostapd/config_file.c        | 2 ++
@@ -13,7 +13,7 @@
  6 files changed, 19 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 10ea52518..4237a5cca 100644
+index 10ea525..4237a5c 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -3508,6 +3508,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -26,7 +26,7 @@
  		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
  		conf->he_op.he_bss_color_disabled = 0;
 diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
-index ea67aa100..e3a5eb365 100644
+index ea67aa1..e3a5eb3 100644
 --- a/hostapd/hostapd.conf
 +++ b/hostapd/hostapd.conf
 @@ -830,6 +830,11 @@ wmm_ac_vo_acm=0
@@ -42,7 +42,7 @@
  #he_bss_color=1
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 85ad5e444..b283de624 100644
+index 85ad5e4..b283de6 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -268,6 +268,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -54,7 +54,7 @@
  		HE_OPERATION_RTS_THRESHOLD_OFFSET;
  	/* Set default basic MCS/NSS set to single stream MCS 0-7 */
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9ac39619..b8b20a7aa 100644
+index a9ac396..b8b20a7 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -929,6 +929,7 @@ struct hostapd_bss_config {
@@ -66,7 +66,7 @@
  	bool he_su_beamformee;
  	bool he_mu_beamformer;
 diff --git a/src/ap/ieee802_11_he.c b/src/ap/ieee802_11_he.c
-index b5b7e5d46..f27aeb196 100644
+index b5b7e5d..f27aeb1 100644
 --- a/src/ap/ieee802_11_he.c
 +++ b/src/ap/ieee802_11_he.c
 @@ -138,6 +138,13 @@ u8 * hostapd_eid_he_capab(struct hostapd_data *hapd, u8 *eid,
@@ -84,7 +84,7 @@
  		cap->he_phy_capab_info[HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX] |=
  			HE_PHYCAP_SU_BEAMFORMER_CAPAB;
 diff --git a/src/common/ieee802_11_defs.h b/src/common/ieee802_11_defs.h
-index 65e125e83..62088bda6 100644
+index 65e125e..62088bd 100644
 --- a/src/common/ieee802_11_defs.h
 +++ b/src/common/ieee802_11_defs.h
 @@ -2298,6 +2298,9 @@ struct ieee80211_spatial_reuse {
@@ -98,5 +98,5 @@
  #define HE_PHYCAP_SU_BEAMFORMER_CAPAB		((u8) BIT(7))
  #define HE_PHYCAP_SU_BEAMFORMEE_CAPAB_IDX	4
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
deleted file mode 100644
index 1222510..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 52a1775318c9926a1dbf4f7c563e95b5be3c9bd6 Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Tue, 17 Jan 2023 13:25:18 +0800
-Subject: [PATCH 13/15] hostapd: mtk: Add the broadcast destination address of
- Probe Response frame on 6 GHz
-
-According to IEEE 802.11ax 26.17.2.3.2,
-if a 6 GHz AP receives a Probe Request frame and responds with a Probe Response frame,
-the Address 1 field of the Probe Response frame shall be set to the broadcast address,
-unless the AP is not indicating its actual SSID in the SSID element of its Beacon frames.
-
-Without this, hostapd fill the Address 1 feild of the Probe Response frame
-with the source address from Probe Request frame on 6 GHz.
-Fix this to use broadcast address instead.
-
-Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
----
- src/ap/beacon.c | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 1a26f11ff..f3ea5c277 100644
---- a/src/ap/beacon.c
-+++ b/src/ap/beacon.c
-@@ -1156,8 +1156,13 @@ void handle_probe_req(struct hostapd_data *hapd,
- 	wpa_msg_ctrl(hapd->msg_ctx, MSG_INFO, RX_PROBE_REQUEST "sa=" MACSTR
- 		     " signal=%d", MAC2STR(mgmt->sa), ssi_signal);
- 
--	resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
--				      &resp_len, false);
-+	if (is_6ghz_op_class(hapd->iconf->op_class) &&
-+	    is_broadcast_ether_addr(mgmt->da))
-+		resp = hostapd_gen_probe_resp(hapd, NULL, elems.p2p != NULL,
-+					      &resp_len, true);
-+	else
-+		resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
-+					      &resp_len, false);
- 	if (resp == NULL)
- 		return;
- 
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
similarity index 89%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
copy to recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
index 1222510..f0d25c6 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
@@ -1,7 +1,7 @@
-From 52a1775318c9926a1dbf4f7c563e95b5be3c9bd6 Mon Sep 17 00:00:00 2001
+From bb5cb086162828392a04820063ad7997d8ae26d7 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 17 Jan 2023 13:25:18 +0800
-Subject: [PATCH 13/15] hostapd: mtk: Add the broadcast destination address of
+Subject: [PATCH 14/16] hostapd: mtk: Add the broadcast destination address of
  Probe Response frame on 6 GHz
 
 According to IEEE 802.11ax 26.17.2.3.2,
@@ -19,7 +19,7 @@
  1 file changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 1a26f11ff..f3ea5c277 100644
+index 1a26f11..f3ea5c2 100644
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
 @@ -1156,8 +1156,13 @@ void handle_probe_req(struct hostapd_data *hapd,
@@ -39,5 +39,5 @@
  		return;
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
deleted file mode 100644
index 3689f74..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 7d741c99f2e211abe70593ff6e8265633bed0d8a Mon Sep 17 00:00:00 2001
-From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
-Date: Tue, 24 Jan 2023 19:06:44 +0800
-Subject: [PATCH 14/15] hostapd: mtk: Add vendor command attribute for RTS BW
- signaling.
-
-Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
----
- src/common/mtk_vendor.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9e2..fb12895ce 100644
---- a/src/common/mtk_vendor.h
-+++ b/src/common/mtk_vendor.h
-@@ -169,6 +169,7 @@ enum mtk_vendor_attr_wireless_ctrl {
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_RTS_SIGTA,
- 
- 	/* keep last */
- 	NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
--- 
-2.25.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch
deleted file mode 100644
index 642c625..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 619075bb430c908c61a818c45e36f1ca76020741 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 13 Feb 2023 11:03:53 +0800
-Subject: [PATCH 15/15] hostapd: mtk: 6G band does not require DFS
-
----
- src/ap/dfs.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index 1c3f6785b..4b1e64246 100644
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -1506,6 +1506,7 @@ int hostapd_is_dfs_required(struct hostapd_iface *iface)
- 	if ((!(iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD) &&
- 	     !iface->conf->ieee80211h) ||
- 	    !iface->current_mode ||
-+	    is_6ghz_freq(iface->freq) ||
- 	    iface->current_mode->mode != HOSTAPD_MODE_IEEE80211A)
- 		return 0;
- 
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
similarity index 79%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
copy to recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
index 3689f74..5fcd0c5 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
@@ -1,7 +1,7 @@
-From 7d741c99f2e211abe70593ff6e8265633bed0d8a Mon Sep 17 00:00:00 2001
+From 1db373190399a907b27141c199841aeafd4643da Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Tue, 24 Jan 2023 19:06:44 +0800
-Subject: [PATCH 14/15] hostapd: mtk: Add vendor command attribute for RTS BW
+Subject: [PATCH 15/16] hostapd: mtk: Add vendor command attribute for RTS BW
  signaling.
 
 Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9e2..fb12895ce 100644
+index 0999ea9..fb12895 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -169,6 +169,7 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -22,5 +22,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
similarity index 76%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch
copy to recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
index 642c625..33fea78 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
@@ -1,14 +1,14 @@
-From 619075bb430c908c61a818c45e36f1ca76020741 Mon Sep 17 00:00:00 2001
+From efa1d271d28c84b8ca77ffc3ca7cb75e727088a0 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 13 Feb 2023 11:03:53 +0800
-Subject: [PATCH 15/15] hostapd: mtk: 6G band does not require DFS
+Subject: [PATCH 16/16] hostapd: mtk: 6G band does not require DFS
 
 ---
  src/ap/dfs.c | 1 +
  1 file changed, 1 insertion(+)
 
 diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index 1c3f6785b..4b1e64246 100644
+index 1c3f678..4b1e642 100644
 --- a/src/ap/dfs.c
 +++ b/src/ap/dfs.c
 @@ -1506,6 +1506,7 @@ int hostapd_is_dfs_required(struct hostapd_iface *iface)
@@ -20,5 +20,5 @@
  		return 0;
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
new file mode 100644
index 0000000..265c37a
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
@@ -0,0 +1,46 @@
+From f6bfd9a4a6c0d08e0dec9311873c9e863a07c9a8 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 11:01:18 +0800
+Subject: [PATCH] hostapd: mtk: Fix sending wrong VHT operation IE in CSA while
+ using ZWDFS
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ src/ap/dfs.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 4b1e642..307a4e1 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1110,6 +1110,14 @@ static int
+ hostapd_dfs_start_channel_switch_background(struct hostapd_iface *iface)
+ {
+ 	u8 current_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
++	int ret;
++
++	ret = hostapd_dfs_request_channel_switch(iface, iface->radar_background.channel,
++						 iface->radar_background.freq,
++						 iface->radar_background.secondary_channel,
++						 current_vht_oper_chwidth,
++						 iface->radar_background.centr_freq_seg0_idx,
++						 iface->radar_background.centr_freq_seg1_idx);
+ 
+ 	iface->conf->channel = iface->radar_background.channel;
+ 	iface->freq = iface->radar_background.freq;
+@@ -1122,11 +1130,7 @@ hostapd_dfs_start_channel_switch_background(struct hostapd_iface *iface)
+ 
+ 	hostpad_dfs_update_background_chain(iface);
+ 
+-	return hostapd_dfs_request_channel_switch(
+-		iface, iface->conf->channel, iface->freq,
+-		iface->conf->secondary_channel, current_vht_oper_chwidth,
+-		hostapd_get_oper_centr_freq_seg0_idx(iface->conf),
+-		hostapd_get_oper_centr_freq_seg1_idx(iface->conf));
++	return ret;
+ }
+ 
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
new file mode 100644
index 0000000..db3c813
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
@@ -0,0 +1,189 @@
+From 3337e7b4f75a66e53e1320e49deba2b58a8a80b0 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 10:51:47 +0800
+Subject: [PATCH 18/19] hostapd: mtk: Add sta-assisted DFS state update
+ mechanism
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ src/ap/dfs.c                       | 20 ++++++++++++++++++++
+ src/ap/dfs.h                       |  3 +++
+ src/ap/drv_callbacks.c             | 28 ++++++++++++++++++++++++++++
+ src/common/wpa_ctrl.h              |  1 +
+ src/drivers/driver.h               | 14 ++++++++++++++
+ src/drivers/driver_nl80211_event.c |  6 ++++++
+ src/drivers/nl80211_copy.h         |  6 ++++++
+ 7 files changed, 78 insertions(+)
+
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 307a4e1..d082fe0 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1503,6 +1503,26 @@ int hostapd_dfs_nop_finished(struct hostapd_iface *iface, int freq,
+ }
+ 
+ 
++int hostapd_dfs_sta_update_state(struct hostapd_iface *iface, int freq,
++				 int ht_enabled, int chan_offset, int chan_width,
++				 int cf1, int cf2, u32 state)
++{
++	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_STA_UPDATE
++		"freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d state=%s",
++		freq, ht_enabled, chan_offset, chan_width, cf1, cf2,
++		(state == HOSTAPD_CHAN_DFS_AVAILABLE) ? "available" : "usable");
++
++	/* Proceed only if DFS is not offloaded to the driver */
++	if (iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD)
++		return 0;
++
++	set_dfs_state(iface, freq, ht_enabled, chan_offset, chan_width,
++		      cf1, cf2, state);
++
++	return 0;
++}
++
++
+ int hostapd_is_dfs_required(struct hostapd_iface *iface)
+ {
+ 	int n_chans, n_chans1, start_chan_idx, start_chan_idx1, res;
+diff --git a/src/ap/dfs.h b/src/ap/dfs.h
+index c2556d2..25ba29c 100644
+--- a/src/ap/dfs.h
++++ b/src/ap/dfs.h
+@@ -30,6 +30,9 @@ int hostapd_dfs_radar_detected(struct hostapd_iface *iface, int freq,
+ int hostapd_dfs_nop_finished(struct hostapd_iface *iface, int freq,
+ 			     int ht_enabled,
+ 			     int chan_offset, int chan_width, int cf1, int cf2);
++int hostapd_dfs_sta_update_state(struct hostapd_iface *iface, int freq,
++				 int ht_enabled, int chan_offset, int chan_width,
++				 int cf1, int cf2, u32 state);
+ int hostapd_is_dfs_required(struct hostapd_iface *iface);
+ int hostapd_is_dfs_chan_available(struct hostapd_iface *iface);
+ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+diff --git a/src/ap/drv_callbacks.c b/src/ap/drv_callbacks.c
+index 09783cb..275f6b3 100644
+--- a/src/ap/drv_callbacks.c
++++ b/src/ap/drv_callbacks.c
+@@ -1790,6 +1790,24 @@ static void hostapd_event_dfs_cac_started(struct hostapd_data *hapd,
+ 			      radar->cf1, radar->cf2);
+ }
+ 
++static void hostapd_event_dfs_sta_cac_skipped(struct hostapd_data *hapd,
++					      struct dfs_event *radar)
++{
++	wpa_printf(MSG_DEBUG, "DFS CAC skipped (by STA) on %d MHz", radar->freq);
++	hostapd_dfs_sta_update_state(hapd->iface, radar->freq, radar->ht_enabled,
++				     radar->chan_offset, radar->chan_width,
++				     radar->cf1, radar->cf2, HOSTAPD_CHAN_DFS_AVAILABLE);
++}
++
++static void hostapd_event_dfs_sta_cac_expired(struct hostapd_data *hapd,
++					      struct dfs_event *radar)
++{
++	wpa_printf(MSG_DEBUG, "DFS CAC expired (by STA) on %d MHz", radar->freq);
++	hostapd_dfs_sta_update_state(hapd->iface, radar->freq, radar->ht_enabled,
++				     radar->chan_offset, radar->chan_width,
++				     radar->cf1, radar->cf2, HOSTAPD_CHAN_DFS_USABLE);
++}
++
+ #endif /* NEED_AP_MLME */
+ 
+ 
+@@ -2064,6 +2082,16 @@ void hostapd_wpa_event(void *ctx, enum wpa_event_type event,
+ 			break;
+ 		hostapd_event_dfs_nop_finished(hapd, &data->dfs_event);
+ 		break;
++	case EVENT_DFS_STA_CAC_SKIPPED:
++		if (!data)
++			break;
++		hostapd_event_dfs_sta_cac_skipped(hapd, &data->dfs_event);
++		break;
++	case EVENT_DFS_STA_CAC_EXPIRED:
++		if (!data)
++			break;
++		hostapd_event_dfs_sta_cac_expired(hapd, &data->dfs_event);
++		break;
+ 	case EVENT_CHANNEL_LIST_CHANGED:
+ 		/* channel list changed (regulatory?), update channel list */
+ 		/* TODO: check this. hostapd_get_hw_features() initializes
+diff --git a/src/common/wpa_ctrl.h b/src/common/wpa_ctrl.h
+index 3435084..79c8a82 100644
+--- a/src/common/wpa_ctrl.h
++++ b/src/common/wpa_ctrl.h
+@@ -360,6 +360,7 @@ extern "C" {
+ #define DFS_EVENT_CAC_COMPLETED "DFS-CAC-COMPLETED "
+ #define DFS_EVENT_NOP_FINISHED "DFS-NOP-FINISHED "
+ #define DFS_EVENT_PRE_CAC_EXPIRED "DFS-PRE-CAC-EXPIRED "
++#define DFS_EVENT_STA_UPDATE "DFS-STA-UPDATE "
+ 
+ #define AP_CSA_FINISHED "AP-CSA-FINISHED "
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 265d86d..b5de0e6 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -5317,6 +5317,20 @@ enum wpa_event_type {
+ 	 * EVENT_CCA_NOTIFY - Notification that CCA has completed
+ 	 */
+ 	EVENT_CCA_NOTIFY,
++
++	/**
++	 * EVENT_DFS_STA_CAC_SKIPPED - Notification that CAC has been skipped
++	 *
++	 * The channel in the notification is now marked as available.
++	 */
++	EVENT_DFS_STA_CAC_SKIPPED,
++
++	/**
++	 * EVENT_DFS_STA_CAC_EXPIRED - Notification that CAC has expired
++	 *
++	 * The channel in the notification is now marked as usable.
++	 */
++	EVENT_DFS_STA_CAC_EXPIRED,
+ };
+ 
+ 
+diff --git a/src/drivers/driver_nl80211_event.c b/src/drivers/driver_nl80211_event.c
+index 73bb7a4..ee922ac 100644
+--- a/src/drivers/driver_nl80211_event.c
++++ b/src/drivers/driver_nl80211_event.c
+@@ -1854,6 +1854,12 @@ static void nl80211_radar_event(struct wpa_driver_nl80211_data *drv,
+ 	case NL80211_RADAR_CAC_STARTED:
+ 		wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_STARTED, &data);
+ 		break;
++	case NL80211_RADAR_STA_CAC_SKIPPED:
++		wpa_supplicant_event(drv->ctx, EVENT_DFS_STA_CAC_SKIPPED, &data);
++		break;
++	case NL80211_RADAR_STA_CAC_EXPIRED:
++		wpa_supplicant_event(drv->ctx, EVENT_DFS_STA_CAC_EXPIRED, &data);
++		break;
+ 	default:
+ 		wpa_printf(MSG_DEBUG, "nl80211: Unknown radar event %d "
+ 			   "received", event_type);
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index c4bf3ad..0937752 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -6431,6 +6431,10 @@ enum nl80211_smps_mode {
+  *	applicable for ETSI dfs domain where pre-CAC is valid for ever.
+  * @NL80211_RADAR_CAC_STARTED: Channel Availability Check has been started,
+  *	should be generated by HW if NL80211_EXT_FEATURE_DFS_OFFLOAD is enabled.
++ * @NL80211_RADAR_STA_CAC_SKIPPED: STA set the DFS state to available
++ *	when receiving CSA/assoc resp
++ * @NL80211_RADAR_STA_CAC_EXPIRED: STA set the DFS state to usable
++ *	when STA is disconnected or leaving the channel
+  */
+ enum nl80211_radar_event {
+ 	NL80211_RADAR_DETECTED,
+@@ -6439,6 +6443,8 @@ enum nl80211_radar_event {
+ 	NL80211_RADAR_NOP_FINISHED,
+ 	NL80211_RADAR_PRE_CAC_EXPIRED,
+ 	NL80211_RADAR_CAC_STARTED,
++	NL80211_RADAR_STA_CAC_SKIPPED,
++	NL80211_RADAR_STA_CAC_EXPIRED,
+ };
+ 
+ /**
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
new file mode 100644
index 0000000..8340fd9
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
@@ -0,0 +1,43 @@
+From 83ab1a9cc51225095842d3c62bf75cf4efe63075 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 16:58:20 +0800
+Subject: [PATCH] hostapd: mtk: Fix auto ht issue when switching to DFS channel
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 0ad8451..407790f 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -2698,6 +2698,12 @@ static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
+ 		break;
+ 	}
+ 
++	if (os_strstr(pos, " auto-ht")) {
++		settings.freq_params.ht_enabled = iface->conf->ieee80211n;
++		settings.freq_params.vht_enabled = iface->conf->ieee80211ac;
++		settings.freq_params.he_enabled = iface->conf->ieee80211ax;
++	}
++
+ 	if (settings.freq_params.center_freq1)
+ 		dfs_range += hostapd_is_dfs_overlap(
+ 			iface, bandwidth, settings.freq_params.center_freq1);
+@@ -2735,12 +2741,6 @@ static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
+ 		return 0;
+ 	}
+ 
+-	if (os_strstr(pos, " auto-ht")) {
+-		settings.freq_params.ht_enabled = iface->conf->ieee80211n;
+-		settings.freq_params.vht_enabled = iface->conf->ieee80211ac;
+-		settings.freq_params.he_enabled = iface->conf->ieee80211ax;
+-	}
+-
+ 	for (i = 0; i < iface->num_bss; i++) {
+ 
+ 		/* Save CHAN_SWITCH VHT, HE, and EHT config */
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
index 4a42f53..78d5240 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
@@ -71,11 +71,15 @@
     file://mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch \
     file://mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch \
     file://mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch \
-    file://mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch \
-    file://mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch \
-    file://mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch \
-    file://mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch \
-    file://mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch \
-    file://mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch \
+    file://mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch \
+    file://mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch \
+    file://mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch \
+    file://mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch \
+    file://mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch \
+    file://mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch \
+    file://mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch \
+    file://mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch \
+    file://mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch \
+    file://mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch \
     file://mtk-0100-hostapd-mtk-update-eht-operation-elem.patch \
     "
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
deleted file mode 100644
index 3237aa3..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
+++ /dev/null
@@ -1,376 +0,0 @@
-From 4e7c861c971ca49ea162bd908fef6021a62b9018 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Fri, 7 Oct 2022 10:46:29 +0800
-Subject: [PATCH 10/15] hostapd: mtk: Add DFS and ZWDFS support
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- hostapd/config_file.c        |  4 ++
- hostapd/ctrl_iface.c         | 95 ++++++++++++++++++++++++++++++++++++
- src/ap/ap_config.h           | 13 +++++
- src/ap/dfs.c                 | 35 +++++++------
- src/ap/dfs.h                 | 15 ++++++
- src/ap/hostapd.c             |  4 +-
- src/drivers/driver.h         |  7 +++
- src/drivers/driver_nl80211.c | 29 +++++++++++
- src/drivers/nl80211_copy.h   |  1 +
- 9 files changed, 186 insertions(+), 17 deletions(-)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 63c9d40be..cd1534952 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -4803,6 +4803,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
- 		int val = atoi(pos);
- 		conf->ibf_enable = !!val;
-+	} else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
-+		u8 en = strtol(pos, NULL, 10);
-+
-+		conf->dfs_detect_mode = en;
- 	} else {
- 		wpa_printf(MSG_ERROR,
- 			   "Line %d: unknown configuration item '%s'",
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index c881d3717..6ea1573b8 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -3522,6 +3522,96 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
- }
- 
- 
-+static int
-+hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
-+				       char *buf, size_t buflen)
-+{
-+	u8 dfs_detect_mode;
-+
-+	if (!value)
-+		return -1;
-+
-+	dfs_detect_mode = strtol(value, NULL, 10);
-+	if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
-+		wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
-+		return -1;
-+	}
-+	hapd->iconf->dfs_detect_mode = dfs_detect_mode;
-+
-+	return os_snprintf(buf, buflen, "OK\n");
-+}
-+
-+
-+static int
-+hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
-+				    char *buf, size_t buflen)
-+{
-+	struct hostapd_iface *iface = hapd->iface;
-+	char *pos, *param;
-+	enum hostapd_hw_mode hw_mode;
-+	bool chan_found = false;
-+	int i, num_available_chandefs, channel, chan_width, sec = 0;
-+	int sec_chan_idx_80p80 = -1;
-+	u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
-+	struct hostapd_channel_data *chan;
-+	enum dfs_channel_type type = DFS_NO_CAC_YET;
-+
-+	param = os_strchr(cmd, ' ');
-+	if (!param)
-+		return -1;
-+	*param++ = '\0';
-+
-+	pos = os_strstr(param, "chan=");
-+	if (pos)
-+		channel = strtol(pos + 5, NULL, 10);
-+	else
-+		return -1;
-+
-+	num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
-+	for (i = 0; i < num_available_chandefs; i++) {
-+		dfs_find_channel(iface, &chan, i, type);
-+		if (chan->chan == channel) {
-+			chan_found = true;
-+			break;
-+		}
-+	}
-+
-+	if (!chan_found)
-+		return -1;
-+
-+	if (iface->conf->secondary_channel)
-+		sec = 1;
-+
-+	dfs_adjust_center_freq(iface, chan,
-+			       sec,
-+			       sec_chan_idx_80p80,
-+			       &oper_centr_freq_seg0_idx,
-+			       &oper_centr_freq_seg1_idx);
-+
-+	if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
-+				  chan->freq, chan->chan,
-+				  iface->conf->ieee80211n,
-+				  iface->conf->ieee80211ac,
-+				  iface->conf->ieee80211ax,
-+				  iface->conf->ieee80211be,
-+				  sec, hostapd_get_oper_chwidth(iface->conf),
-+				  oper_centr_freq_seg0_idx,
-+				  oper_centr_freq_seg1_idx, true)) {
-+		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
-+		iface->radar_background.channel = -1;
-+		return -1;
-+	}
-+
-+	iface->radar_background.channel = chan->chan;
-+	iface->radar_background.freq = chan->freq;
-+	iface->radar_background.secondary_channel = sec;
-+	iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
-+	iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
-+
-+	return os_snprintf(buf, buflen, "OK\n");
-+}
-+
-+
- static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 					      char *buf, char *reply,
- 					      int reply_size,
-@@ -4081,6 +4171,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 		reply_len = hostapd_ctrl_iface_get_mu(hapd, reply, reply_size);
- 	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
- 		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
-+	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
-+		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
-+								   reply, reply_size);
-+	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
-+		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
- 	} else {
- 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
- 		reply_len = 16;
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9e3d2aeb..77f6169d2 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -1160,6 +1160,7 @@ struct hostapd_config {
- 	int *edcca_threshold;
- 	u8 three_wire_enable;
- 	u8 ibf_enable;
-+	u8 dfs_detect_mode;
- };
- 
- enum three_wire_mode {
-@@ -1174,6 +1175,18 @@ enum three_wire_mode {
- 		NUM_THREE_WIRE_MODE - 1
- };
- 
-+enum dfs_mode {
-+	DFS_DETECT_MODE_DISABLE,
-+	DFS_DETECT_MODE_AP_ENABLE,
-+	DFS_DETECT_MODE_BACKGROUND_ENABLE,
-+	DFS_DETECT_MODE_ALL_ENABLE,
-+
-+	/* keep last */
-+	NUM_DFS_DETECT_MODE,
-+	DFS_DETECT_MODE_MAX =
-+		NUM_DFS_DETECT_MODE - 1
-+};
-+
- enum edcca_mode {
- 	EDCCA_MODE_FORCE_DISABLE = 0,
- 	EDCCA_MODE_AUTO = 1,
-diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index b5d105d6a..1c3f6785b 100644
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -19,13 +19,6 @@
- #include "dfs.h"
- #include "crypto/crypto.h"
- 
--
--enum dfs_channel_type {
--	DFS_ANY_CHANNEL,
--	DFS_AVAILABLE, /* non-radar or radar-available */
--	DFS_NO_CAC_YET, /* radar-not-yet-available */
--};
--
- static struct hostapd_channel_data *
- dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
- 			u8 *oper_centr_freq_seg0_idx,
-@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
-  *  - hapd->vht/he_oper_centr_freq_seg0_idx
-  *  - hapd->vht/he_oper_centr_freq_seg1_idx
-  */
--static int dfs_find_channel(struct hostapd_iface *iface,
--			    struct hostapd_channel_data **ret_chan,
--			    int idx, enum dfs_channel_type type)
-+int dfs_find_channel(struct hostapd_iface *iface,
-+		     struct hostapd_channel_data **ret_chan,
-+		     int idx, enum dfs_channel_type type)
- {
- 	struct hostapd_hw_modes *mode;
- 	struct hostapd_channel_data *chan;
-@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
- }
- 
- 
--static void dfs_adjust_center_freq(struct hostapd_iface *iface,
--				   struct hostapd_channel_data *chan,
--				   int secondary_channel,
--				   int sec_chan_idx_80p80,
--				   u8 *oper_centr_freq_seg0_idx,
--				   u8 *oper_centr_freq_seg1_idx)
-+void dfs_adjust_center_freq(struct hostapd_iface *iface,
-+			    struct hostapd_channel_data *chan,
-+			    int secondary_channel,
-+			    int sec_chan_idx_80p80,
-+			    u8 *oper_centr_freq_seg0_idx,
-+			    u8 *oper_centr_freq_seg1_idx)
- {
- 	if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
- 		return;
-@@ -1317,6 +1310,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
- 		   __func__, iface->radar_background.cac_started ? "yes" : "no",
- 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
- 
-+	/* Skip channel switch when background dfs detect mode is on */
-+	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
-+	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
-+		return 0;
-+
- 	/* Check if CSA in progress */
- 	if (hostapd_csa_in_progress(iface))
- 		return 0;
-@@ -1365,6 +1363,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
- 		   __func__, iface->cac_started ? "yes" : "no",
- 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
- 
-+	/* Skip channel switch when dfs detect mode is on */
-+	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
-+	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
-+		return 0;
-+
- 	/* Check if CSA in progress */
- 	if (hostapd_csa_in_progress(iface))
- 		return 0;
-diff --git a/src/ap/dfs.h b/src/ap/dfs.h
-index 606c1b393..c2556d2d9 100644
---- a/src/ap/dfs.h
-+++ b/src/ap/dfs.h
-@@ -9,6 +9,12 @@
- #ifndef DFS_H
- #define DFS_H
- 
-+enum dfs_channel_type {
-+	DFS_ANY_CHANNEL,
-+	DFS_AVAILABLE, /* non-radar or radar-available */
-+	DFS_NO_CAC_YET, /* radar-not-yet-available */
-+};
-+
- int hostapd_handle_dfs(struct hostapd_iface *iface);
- 
- int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
-@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
- int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
- int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
- 			   int center_freq);
-+int dfs_find_channel(struct hostapd_iface *iface,
-+		     struct hostapd_channel_data **ret_chan,
-+		     int idx, enum dfs_channel_type type);
-+void dfs_adjust_center_freq(struct hostapd_iface *iface,
-+			    struct hostapd_channel_data *chan,
-+			    int secondary_channel,
-+			    int sec_chan_idx_80p80,
-+			    u8 *oper_centr_freq_seg0_idx,
-+			    u8 *oper_centr_freq_seg1_idx);
- 
- #endif /* DFS_H */
-diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index da7f7d87b..a0229c9ca 100644
---- a/src/ap/hostapd.c
-+++ b/src/ap/hostapd.c
-@@ -1464,7 +1464,9 @@ static int hostapd_setup_bss(struct hostapd_data *hapd, int first)
- 		return -1;
- 	}
- 
--	if (!conf->start_disabled && ieee802_11_set_beacon(hapd) < 0)
-+	if (conf->start_disabled)
-+		hapd->driver->start_disabled(hapd->drv_priv);
-+	else if (ieee802_11_set_beacon(hapd) < 0)
- 		return -1;
- 
- 	if (flush_old_stations && !conf->start_disabled &&
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 71ded617f..aa23fbdb3 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -4720,6 +4720,13 @@ struct wpa_driver_ops {
- 	 *
- 	 */
- 	int (*ibf_dump)(void *priv, u8 *ibf_enable);
-+
-+	/**
-+	 * start_disabled - set start_disabled to cfg80211
-+	 * @priv: Private driver interface data
-+	 *
-+	 */
-+	int (*start_disabled)(void *priv);
- };
- 
- /**
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 5c2a291ca..7472542cc 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -12776,6 +12776,34 @@ fail:
- 	return -ENOBUFS;
- }
- 
-+static int nl80211_start_disabled(void *priv)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_NEW_BEACON);
-+	if (!msg)
-+		goto fail;
-+
-+	if (nla_put_flag(msg, NL80211_ATTR_START_DISABLED))
-+		goto fail;
-+
-+	ret = send_and_recv_msgs_connect_handle(drv, msg, bss, 1);
-+
-+	if (ret)
-+		wpa_printf(MSG_ERROR, "Failed to set start_disabled. ret=%d (%s)",
-+			   ret, strerror(-ret));
-+
-+	return ret;
-+
-+fail:
-+	nlmsg_free(msg);
-+	return ret;
-+}
-+
- const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.name = "nl80211",
- 	.desc = "Linux nl80211/cfg80211",
-@@ -12930,4 +12958,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.three_wire_ctrl = nl80211_enable_three_wire,
- 	.ibf_ctrl = nl80211_ibf_enable,
- 	.ibf_dump = nl80211_ibf_dump,
-+	.start_disabled = nl80211_start_disabled,
- };
-diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index c4bf3ad35..79bc76c57 100644
---- a/src/drivers/nl80211_copy.h
-+++ b/src/drivers/nl80211_copy.h
-@@ -3176,6 +3176,7 @@ enum nl80211_attrs {
- 	NL80211_ATTR_EHT_CAPABILITY,
- 
- 	/* add attributes here, update the policy in nl80211.c */
-+	NL80211_ATTR_START_DISABLED = 999,
- 
- 	__NL80211_ATTR_AFTER_LAST,
- 	NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
--- 
-2.25.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
new file mode 100644
index 0000000..2ceb639
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
@@ -0,0 +1,136 @@
+From 6828156c206701f5a0e5d30afcc514f452ce0ada Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 14:55:49 +0800
+Subject: [PATCH 10/16] hostapd: mtk: Add DFS detection mode
+
+Add DFS detection mode for testing radar detection rate.
+If DFS detection mode is on, AP will not switch channels when receiving
+a radar signal.
+This detection mode also supports background chain.
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c |  4 ++++
+ hostapd/ctrl_iface.c  | 23 +++++++++++++++++++++++
+ src/ap/ap_config.h    | 13 +++++++++++++
+ src/ap/dfs.c          | 10 ++++++++++
+ 4 files changed, 50 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 63c9d40..cd15349 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4803,6 +4803,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
+ 		int val = atoi(pos);
+ 		conf->ibf_enable = !!val;
++	} else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
++		u8 en = strtol(pos, NULL, 10);
++
++		conf->dfs_detect_mode = en;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c881d37..0b4c234 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3522,6 +3522,26 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
++				       char *buf, size_t buflen)
++{
++	u8 dfs_detect_mode;
++
++	if (!value)
++		return -1;
++
++	dfs_detect_mode = strtol(value, NULL, 10);
++	if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
++		wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
++		return -1;
++	}
++	hapd->iconf->dfs_detect_mode = dfs_detect_mode;
++
++	return os_snprintf(buf, buflen, "OK\n");
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4081,6 +4101,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ 	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
+ 		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
++	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
++		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
++								   reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index a9e3d2a..77f6169 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1160,6 +1160,7 @@ struct hostapd_config {
+ 	int *edcca_threshold;
+ 	u8 three_wire_enable;
+ 	u8 ibf_enable;
++	u8 dfs_detect_mode;
+ };
+ 
+ enum three_wire_mode {
+@@ -1174,6 +1175,18 @@ enum three_wire_mode {
+ 		NUM_THREE_WIRE_MODE - 1
+ };
+ 
++enum dfs_mode {
++	DFS_DETECT_MODE_DISABLE,
++	DFS_DETECT_MODE_AP_ENABLE,
++	DFS_DETECT_MODE_BACKGROUND_ENABLE,
++	DFS_DETECT_MODE_ALL_ENABLE,
++
++	/* keep last */
++	NUM_DFS_DETECT_MODE,
++	DFS_DETECT_MODE_MAX =
++		NUM_DFS_DETECT_MODE - 1
++};
++
+ enum edcca_mode {
+ 	EDCCA_MODE_FORCE_DISABLE = 0,
+ 	EDCCA_MODE_AUTO = 1,
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index b5d105d..5cb7799 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1317,6 +1317,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ 		   __func__, iface->radar_background.cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when background dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+@@ -1365,6 +1370,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
+ 		   __func__, iface->cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
new file mode 100644
index 0000000..1d8baf8
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
@@ -0,0 +1,192 @@
+From 88dd3df28e3736af4cca0daf4f7d19ab888ea6c4 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 14:56:55 +0800
+Subject: [PATCH 11/16] hostapd: mtk: Add DFS offchan channel switch
+
+Add DFS background chain channel switch command for testing purpose.
+This feature is implemented via hostapd_cli command.
+Command format:
+hostapd_cli -i <interface> raw SET_OFFCHAN_CTRL chan=<dfs_channel>
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 72 ++++++++++++++++++++++++++++++++++++++++++++
+ src/ap/dfs.c         | 25 ++++++---------
+ src/ap/dfs.h         | 15 +++++++++
+ 3 files changed, 96 insertions(+), 16 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 0b4c234..6ea1573 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3542,6 +3542,76 @@ hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
++				    char *buf, size_t buflen)
++{
++	struct hostapd_iface *iface = hapd->iface;
++	char *pos, *param;
++	enum hostapd_hw_mode hw_mode;
++	bool chan_found = false;
++	int i, num_available_chandefs, channel, chan_width, sec = 0;
++	int sec_chan_idx_80p80 = -1;
++	u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
++	struct hostapd_channel_data *chan;
++	enum dfs_channel_type type = DFS_NO_CAC_YET;
++
++	param = os_strchr(cmd, ' ');
++	if (!param)
++		return -1;
++	*param++ = '\0';
++
++	pos = os_strstr(param, "chan=");
++	if (pos)
++		channel = strtol(pos + 5, NULL, 10);
++	else
++		return -1;
++
++	num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
++	for (i = 0; i < num_available_chandefs; i++) {
++		dfs_find_channel(iface, &chan, i, type);
++		if (chan->chan == channel) {
++			chan_found = true;
++			break;
++		}
++	}
++
++	if (!chan_found)
++		return -1;
++
++	if (iface->conf->secondary_channel)
++		sec = 1;
++
++	dfs_adjust_center_freq(iface, chan,
++			       sec,
++			       sec_chan_idx_80p80,
++			       &oper_centr_freq_seg0_idx,
++			       &oper_centr_freq_seg1_idx);
++
++	if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
++				  chan->freq, chan->chan,
++				  iface->conf->ieee80211n,
++				  iface->conf->ieee80211ac,
++				  iface->conf->ieee80211ax,
++				  iface->conf->ieee80211be,
++				  sec, hostapd_get_oper_chwidth(iface->conf),
++				  oper_centr_freq_seg0_idx,
++				  oper_centr_freq_seg1_idx, true)) {
++		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
++		iface->radar_background.channel = -1;
++		return -1;
++	}
++
++	iface->radar_background.channel = chan->chan;
++	iface->radar_background.freq = chan->freq;
++	iface->radar_background.secondary_channel = sec;
++	iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
++	iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
++
++	return os_snprintf(buf, buflen, "OK\n");
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4104,6 +4174,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
+ 		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
+ 								   reply, reply_size);
++	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
++		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 5cb7799..1c3f678 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -19,13 +19,6 @@
+ #include "dfs.h"
+ #include "crypto/crypto.h"
+ 
+-
+-enum dfs_channel_type {
+-	DFS_ANY_CHANNEL,
+-	DFS_AVAILABLE, /* non-radar or radar-available */
+-	DFS_NO_CAC_YET, /* radar-not-yet-available */
+-};
+-
+ static struct hostapd_channel_data *
+ dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
+ 			u8 *oper_centr_freq_seg0_idx,
+@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
+  *  - hapd->vht/he_oper_centr_freq_seg0_idx
+  *  - hapd->vht/he_oper_centr_freq_seg1_idx
+  */
+-static int dfs_find_channel(struct hostapd_iface *iface,
+-			    struct hostapd_channel_data **ret_chan,
+-			    int idx, enum dfs_channel_type type)
++int dfs_find_channel(struct hostapd_iface *iface,
++		     struct hostapd_channel_data **ret_chan,
++		     int idx, enum dfs_channel_type type)
+ {
+ 	struct hostapd_hw_modes *mode;
+ 	struct hostapd_channel_data *chan;
+@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
+ }
+ 
+ 
+-static void dfs_adjust_center_freq(struct hostapd_iface *iface,
+-				   struct hostapd_channel_data *chan,
+-				   int secondary_channel,
+-				   int sec_chan_idx_80p80,
+-				   u8 *oper_centr_freq_seg0_idx,
+-				   u8 *oper_centr_freq_seg1_idx)
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++			    struct hostapd_channel_data *chan,
++			    int secondary_channel,
++			    int sec_chan_idx_80p80,
++			    u8 *oper_centr_freq_seg0_idx,
++			    u8 *oper_centr_freq_seg1_idx)
+ {
+ 	if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
+ 		return;
+diff --git a/src/ap/dfs.h b/src/ap/dfs.h
+index 606c1b3..c2556d2 100644
+--- a/src/ap/dfs.h
++++ b/src/ap/dfs.h
+@@ -9,6 +9,12 @@
+ #ifndef DFS_H
+ #define DFS_H
+ 
++enum dfs_channel_type {
++	DFS_ANY_CHANNEL,
++	DFS_AVAILABLE, /* non-radar or radar-available */
++	DFS_NO_CAC_YET, /* radar-not-yet-available */
++};
++
+ int hostapd_handle_dfs(struct hostapd_iface *iface);
+ 
+ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+ int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
+ int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
+ 			   int center_freq);
++int dfs_find_channel(struct hostapd_iface *iface,
++		     struct hostapd_channel_data **ret_chan,
++		     int idx, enum dfs_channel_type type);
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++			    struct hostapd_channel_data *chan,
++			    int secondary_channel,
++			    int sec_chan_idx_80p80,
++			    u8 *oper_centr_freq_seg0_idx,
++			    u8 *oper_centr_freq_seg1_idx);
+ 
+ #endif /* DFS_H */
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
deleted file mode 100644
index dba90d1..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
+++ /dev/null
@@ -1,400 +0,0 @@
-From bc0722ebc1cc08be6239879fddaef37e0db2d9e0 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Fri, 16 Dec 2022 03:57:11 +0800
-Subject: [PATCH 11/15] hostapd: mtk: Add amsdu set get ctrl
-
----
- hostapd/config_file.c             |   9 +++
- hostapd/ctrl_iface.c              |  26 +++++++
- hostapd/hostapd_cli.c             |   9 +++
- src/ap/ap_config.c                |   1 +
- src/ap/ap_config.h                |   1 +
- src/ap/ap_drv_ops.c               |  14 ++++
- src/ap/ap_drv_ops.h               |   2 +
- src/ap/hostapd.c                  |   2 +
- src/common/mtk_vendor.h           |  17 ++++-
- src/drivers/driver.h              |   9 +++
- src/drivers/driver_nl80211.c      | 114 ++++++++++++++++++++++++++++++
- src/drivers/driver_nl80211.h      |   1 +
- src/drivers/driver_nl80211_capa.c |   3 +
- 13 files changed, 207 insertions(+), 1 deletion(-)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd1534952..10ea52518 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -4807,6 +4807,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 		u8 en = strtol(pos, NULL, 10);
- 
- 		conf->dfs_detect_mode = en;
-+	} else if (os_strcmp(buf, "amsdu") == 0) {
-+		int val = atoi(pos);
-+		if (val < 0 || val > 1) {
-+			wpa_printf(MSG_ERROR,
-+					 "Line %d: invalid amsdu value",
-+					 line);
-+			return 1;
-+		}
-+		conf->amsdu = val;
- 	} else {
- 		wpa_printf(MSG_ERROR,
- 			   "Line %d: unknown configuration item '%s'",
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 6ea1573b8..0ad8451aa 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -3612,6 +3612,30 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
- }
- 
- 
-+static int
-+hostapd_ctrl_iface_get_amsdu(struct hostapd_data *hapd, char *buf,
-+					 size_t buflen)
-+{
-+	u8 amsdu;
-+	int ret;
-+	char *pos, *end;
-+
-+	pos = buf;
-+	end = buf + buflen;
-+
-+	if (hostapd_drv_amsdu_dump(hapd, &amsdu) == 0) {
-+		hapd->iconf->amsdu = amsdu;
-+		ret = os_snprintf(pos, end - pos, "[hostapd_cli] AMSDU: %u\n",
-+					hapd->iconf->amsdu);
-+	}
-+
-+	if (os_snprintf_error(end - pos, ret))
-+		return 0;
-+
-+	return ret;
-+}
-+
-+
- static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 					      char *buf, char *reply,
- 					      int reply_size,
-@@ -4176,6 +4200,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 								   reply, reply_size);
- 	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
- 		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
-+	} else if (os_strncmp(buf, "GET_AMSDU", 9) == 0) {
-+		reply_len = hostapd_ctrl_iface_get_amsdu(hapd, reply, reply_size);
- 	} else {
- 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
- 		reply_len = 16;
-diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index c2a123a8c..30b3392e6 100644
---- a/hostapd/hostapd_cli.c
-+++ b/hostapd/hostapd_cli.c
-@@ -1593,6 +1593,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
- }
- 
- 
-+static int hostapd_cli_cmd_get_amsdu(struct wpa_ctrl *ctrl, int argc,
-+					   char *argv[])
-+{
-+	return hostapd_cli_cmd(ctrl, "GET_AMSDU", 0, NULL, NULL);
-+}
-+
-+
- struct hostapd_cli_cmd {
- 	const char *cmd;
- 	int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
-@@ -1796,6 +1803,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
-           "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
- 	{ "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
- 	  " = show iBF state (enabled/disabled)"},
-+	{ "get_amsdu", hostapd_cli_cmd_get_amsdu, NULL,
-+		" = show AMSDU state"},
- 	{ NULL, NULL, NULL, NULL }
- };
- 
-diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 7a96cb8b2..85ad5e444 100644
---- a/src/ap/ap_config.c
-+++ b/src/ap/ap_config.c
-@@ -299,6 +299,7 @@ struct hostapd_config * hostapd_config_defaults(void)
- 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
- 	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
- 	conf->ibf_enable = IBF_DEFAULT_ENABLE;
-+	conf->amsdu = 1;
- 
- 	return conf;
- }
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 77f6169d2..a9ac39619 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -1161,6 +1161,7 @@ struct hostapd_config {
- 	u8 three_wire_enable;
- 	u8 ibf_enable;
- 	u8 dfs_detect_mode;
-+	u8 amsdu;
- };
- 
- enum three_wire_mode {
-diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 60ae8253b..1a82f234c 100644
---- a/src/ap/ap_drv_ops.c
-+++ b/src/ap/ap_drv_ops.c
-@@ -1077,4 +1077,18 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
- 	if (!hapd->driver || !hapd->driver->ibf_dump)
- 		return 0;
- 	return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
-+}
-+
-+int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd)
-+{
-+	if (!hapd->driver || !hapd->driver->amsdu_ctrl)
-+		return 0;
-+	return hapd->driver->amsdu_ctrl(hapd->drv_priv, hapd->iconf->amsdu);
-+}
-+
-+int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu)
-+{
-+	if (!hapd->driver || !hapd->driver->amsdu_dump)
-+		return 0;
-+	return hapd->driver->amsdu_dump(hapd->drv_priv, amsdu);
- }
-\ No newline at end of file
-diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index ab9aedcee..4406666fd 100644
---- a/src/ap/ap_drv_ops.h
-+++ b/src/ap/ap_drv_ops.h
-@@ -147,6 +147,8 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff);
- int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
- int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
- int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
-+int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd);
-+int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu);
- 
- #include "drivers/driver.h"
- 
-diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index a0229c9ca..152060db4 100644
---- a/src/ap/hostapd.c
-+++ b/src/ap/hostapd.c
-@@ -2310,6 +2310,8 @@ dfs_offload:
- 		goto fail;
- 	if (hostapd_drv_ibf_ctrl(hapd) < 0)
- 		goto fail;
-+	if (hostapd_drv_amsdu_ctrl(hapd) < 0)
-+		goto fail;
- 
- 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
- 		   iface->bss[0]->conf->iface);
-diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 4050cf886..0999ea9e2 100644
---- a/src/common/mtk_vendor.h
-+++ b/src/common/mtk_vendor.h
-@@ -167,7 +167,6 @@ enum mtk_vendor_attr_wireless_ctrl {
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
--	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
- 
-@@ -177,6 +176,22 @@ enum mtk_vendor_attr_wireless_ctrl {
- 		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
- };
- 
-+enum mtk_vendor_attr_wireless_dump {
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP,
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX =
-+		NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP - 1
-+};
-+
-+static const struct nla_policy
-+wireless_dump_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP] = {
-+	[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU] = { .type = NLA_U8 },
-+};
-+
- enum mtk_vendor_attr_rfeature_ctrl {
- 	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
- 
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index aa23fbdb3..b07aaf3fe 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -4727,6 +4727,15 @@ struct wpa_driver_ops {
- 	 *
- 	 */
- 	int (*start_disabled)(void *priv);
-+
-+	/**
-+	 * amsdu_ctrl - enable/disable amsdu
-+	 * amsdu_dump - get current amsdu status
-+	 * @priv: Private driver interface data
-+	 *
-+	 */
-+	int (*amsdu_ctrl)(void *priv, u8 amsdu);
-+	int (*amsdu_dump)(void *priv, u8 *amsdu);
- };
- 
- /**
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 7472542cc..6702384ef 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -12804,6 +12804,118 @@ fail:
- 	return ret;
- }
- 
-+static int nl80211_enable_amsdu(void *priv, u8 amsdu)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	if (!drv->mtk_wireless_vendor_cmd_avail) {
-+		wpa_printf(MSG_INFO,
-+			   "nl80211: Driver does not support setting ap wireless control");
-+		return 0;
-+	}
-+
-+	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
-+	if (!msg)
-+		goto fail;
-+
-+	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
-+		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
-+		goto fail;
-+
-+	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
-+	if (!data)
-+		goto fail;
-+
-+	nla_put_u8(msg, MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU, amsdu);
-+
-+	nla_nest_end(msg, data);
-+	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
-+	if (ret) {
-+		wpa_printf(MSG_ERROR, "Failed to set amsdu. ret=%d (%s)", ret, strerror(-ret));
-+	}
-+
-+	return ret;
-+
-+fail:
-+	nlmsg_free(msg);
-+	return -ENOBUFS;
-+}
-+
-+static int dump_amsdu_handler(struct nl_msg *msg, void *arg)
-+{
-+	u8 *amsdu = (u8 *) arg;
-+	struct nlattr *tb[NL80211_ATTR_MAX + 1];
-+	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX + 1];
-+	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
-+	struct nlattr *nl_vend, *attr_amsdu;
-+
-+	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
-+			genlmsg_attrlen(gnlh, 0), NULL);
-+
-+	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
-+	if (!nl_vend)
-+		return NL_SKIP;
-+
-+	nla_parse(tb_vendor, MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX,
-+			nla_data(nl_vend), nla_len(nl_vend), NULL);
-+
-+	attr_amsdu = tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU];
-+	if (!attr_amsdu ){
-+		wpa_printf(MSG_ERROR, "nl80211: cannot find vendor attributes");
-+		return NL_SKIP;
-+	}
-+
-+	*amsdu = nla_get_u8(attr_amsdu);
-+
-+	return NL_SKIP;
-+}
-+
-+static int
-+nl80211_dump_amsdu(void *priv, u8 *amsdu)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	if (!drv->mtk_wireless_vendor_cmd_avail) {
-+		wpa_printf(MSG_INFO,
-+				 "nl80211: Driver does not support ap_wireless control");
-+		return 0;
-+	}
-+
-+	msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
-+	if (!msg)
-+		goto fail;
-+
-+	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
-+		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
-+		goto fail;
-+
-+	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
-+	if (!data)
-+		goto fail;
-+
-+	nla_nest_end(msg, data);
-+
-+	ret = send_and_recv_msgs(drv, msg, dump_amsdu_handler, amsdu, NULL, NULL);
-+
-+	if (ret) {
-+		wpa_printf(MSG_ERROR, "Failed to dump amsdu. ret=%d (%s)", ret, strerror(-ret));
-+	}
-+
-+	return ret;
-+
-+fail:
-+	nlmsg_free(msg);
-+	return -ENOBUFS;
-+}
-+
- const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.name = "nl80211",
- 	.desc = "Linux nl80211/cfg80211",
-@@ -12959,4 +13071,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.ibf_ctrl = nl80211_ibf_enable,
- 	.ibf_dump = nl80211_ibf_dump,
- 	.start_disabled = nl80211_start_disabled,
-+	.amsdu_ctrl = nl80211_enable_amsdu,
-+	.amsdu_dump = nl80211_dump_amsdu,
- };
-diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 607592ceb..e57022409 100644
---- a/src/drivers/driver_nl80211.h
-+++ b/src/drivers/driver_nl80211.h
-@@ -185,6 +185,7 @@ struct wpa_driver_nl80211_data {
- 	unsigned int mtk_mu_vendor_cmd_avail:1;
- 	unsigned int mtk_3wire_vendor_cmd_avail:1;
- 	unsigned int mtk_ibf_vendor_cmd_avail:1;
-+	unsigned int mtk_wireless_vendor_cmd_avail:1;
- 
- 	u64 vendor_scan_cookie;
- 	u64 remain_on_chan_cookie;
-diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 9ecc0ff9a..fcfa68bf7 100644
---- a/src/drivers/driver_nl80211_capa.c
-+++ b/src/drivers/driver_nl80211_capa.c
-@@ -1065,6 +1065,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
- 				case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
- 					drv->mtk_ibf_vendor_cmd_avail = 1;
- 					break;
-+				case MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL:
-+					drv->mtk_wireless_vendor_cmd_avail = 1;
-+					break;
- 				}
- 			}
- 
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
similarity index 92%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
copy to recipes-wifi/wpa-supplicant/files/patches/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
index dba90d1..7db3ae2 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
@@ -1,7 +1,7 @@
-From bc0722ebc1cc08be6239879fddaef37e0db2d9e0 Mon Sep 17 00:00:00 2001
+From d0128fc60d38ce4f20f8368bdc5ea9ed19a329b7 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 16 Dec 2022 03:57:11 +0800
-Subject: [PATCH 11/15] hostapd: mtk: Add amsdu set get ctrl
+Subject: [PATCH 12/16] hostapd: mtk: Add amsdu set get ctrl
 
 ---
  hostapd/config_file.c             |   9 +++
@@ -20,7 +20,7 @@
  13 files changed, 207 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd1534952..10ea52518 100644
+index cd15349..10ea525 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4807,6 +4807,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -40,7 +40,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 6ea1573b8..0ad8451aa 100644
+index 6ea1573..0ad8451 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3612,6 +3612,30 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
@@ -84,7 +84,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index c2a123a8c..30b3392e6 100644
+index c2a123a..30b3392 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1593,6 +1593,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
@@ -111,7 +111,7 @@
  };
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 7a96cb8b2..85ad5e444 100644
+index 7a96cb8..85ad5e4 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -299,6 +299,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -123,7 +123,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 77f6169d2..a9ac39619 100644
+index 77f6169..a9ac396 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1161,6 +1161,7 @@ struct hostapd_config {
@@ -135,7 +135,7 @@
  
  enum three_wire_mode {
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 60ae8253b..1a82f234c 100644
+index 60ae825..1a82f23 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1077,4 +1077,18 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
@@ -159,7 +159,7 @@
  }
 \ No newline at end of file
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index ab9aedcee..4406666fd 100644
+index ab9aedc..4406666 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -147,6 +147,8 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff);
@@ -172,10 +172,10 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index a0229c9ca..152060db4 100644
+index da7f7d8..a18e744 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -2310,6 +2310,8 @@ dfs_offload:
+@@ -2308,6 +2308,8 @@ dfs_offload:
  		goto fail;
  	if (hostapd_drv_ibf_ctrl(hapd) < 0)
  		goto fail;
@@ -185,7 +185,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 4050cf886..0999ea9e2 100644
+index 4050cf8..0999ea9 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -167,7 +167,6 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -220,13 +220,13 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index aa23fbdb3..b07aaf3fe 100644
+index 71ded61..265d86d 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -4727,6 +4727,15 @@ struct wpa_driver_ops {
+@@ -4720,6 +4720,15 @@ struct wpa_driver_ops {
  	 *
  	 */
- 	int (*start_disabled)(void *priv);
+ 	int (*ibf_dump)(void *priv, u8 *ibf_enable);
 +
 +	/**
 +	 * amsdu_ctrl - enable/disable amsdu
@@ -240,11 +240,11 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 7472542cc..6702384ef 100644
+index 5c2a291..d91b29c 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -12804,6 +12804,118 @@ fail:
- 	return ret;
+@@ -12776,6 +12776,118 @@ fail:
+ 	return -ENOBUFS;
  }
  
 +static int nl80211_enable_amsdu(void *priv, u8 amsdu)
@@ -362,15 +362,15 @@
  const struct wpa_driver_ops wpa_driver_nl80211_ops = {
  	.name = "nl80211",
  	.desc = "Linux nl80211/cfg80211",
-@@ -12959,4 +13071,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+@@ -12930,4 +13042,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.three_wire_ctrl = nl80211_enable_three_wire,
  	.ibf_ctrl = nl80211_ibf_enable,
  	.ibf_dump = nl80211_ibf_dump,
- 	.start_disabled = nl80211_start_disabled,
 +	.amsdu_ctrl = nl80211_enable_amsdu,
 +	.amsdu_dump = nl80211_dump_amsdu,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 607592ceb..e57022409 100644
+index 607592c..e570224 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -185,6 +185,7 @@ struct wpa_driver_nl80211_data {
@@ -382,7 +382,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 9ecc0ff9a..fcfa68bf7 100644
+index 9ecc0ff..fcfa68b 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1065,6 +1065,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -396,5 +396,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch
deleted file mode 100644
index 63101e0..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From b49ce922afa13fe8ea5d847753dfb7641b70c9a4 Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Thu, 12 Jan 2023 15:18:19 +0800
-Subject: [PATCH 12/15] hostapd: mtk: Add he_ldpc configuration
-
----
- hostapd/config_file.c        | 2 ++
- hostapd/hostapd.conf         | 5 +++++
- src/ap/ap_config.c           | 1 +
- src/ap/ap_config.h           | 1 +
- src/ap/ieee802_11_he.c       | 7 +++++++
- src/common/ieee802_11_defs.h | 3 +++
- 6 files changed, 19 insertions(+)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 10ea52518..4237a5cca 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -3508,6 +3508,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 		conf->he_phy_capab.he_su_beamformee = atoi(pos);
- 	} else if (os_strcmp(buf, "he_mu_beamformer") == 0) {
- 		conf->he_phy_capab.he_mu_beamformer = atoi(pos);
-+	} else if (os_strcmp(buf, "he_ldpc") == 0) {
-+		conf->he_phy_capab.he_ldpc = atoi(pos);
- 	} else if (os_strcmp(buf, "he_bss_color") == 0) {
- 		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
- 		conf->he_op.he_bss_color_disabled = 0;
-diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
-index ea67aa100..e3a5eb365 100644
---- a/hostapd/hostapd.conf
-+++ b/hostapd/hostapd.conf
-@@ -830,6 +830,11 @@ wmm_ac_vo_acm=0
- # 1 = supported
- #he_mu_beamformer=1
- 
-+#he_ldpc: HE LDPC support
-+# 0 = not supported
-+# 1 = supported (default)
-+#he_ldpc=1
-+
- # he_bss_color: BSS color (1-63)
- #he_bss_color=1
- 
-diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 85ad5e444..b283de624 100644
---- a/src/ap/ap_config.c
-+++ b/src/ap/ap_config.c
-@@ -268,6 +268,7 @@ struct hostapd_config * hostapd_config_defaults(void)
- #endif /* CONFIG_ACS */
- 
- #ifdef CONFIG_IEEE80211AX
-+	conf->he_phy_capab.he_ldpc = 1;
- 	conf->he_op.he_rts_threshold = HE_OPERATION_RTS_THRESHOLD_MASK >>
- 		HE_OPERATION_RTS_THRESHOLD_OFFSET;
- 	/* Set default basic MCS/NSS set to single stream MCS 0-7 */
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9ac39619..b8b20a7aa 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -929,6 +929,7 @@ struct hostapd_bss_config {
-  * struct he_phy_capabilities_info - HE PHY capabilities
-  */
- struct he_phy_capabilities_info {
-+	bool he_ldpc;
- 	bool he_su_beamformer;
- 	bool he_su_beamformee;
- 	bool he_mu_beamformer;
-diff --git a/src/ap/ieee802_11_he.c b/src/ap/ieee802_11_he.c
-index b5b7e5d46..f27aeb196 100644
---- a/src/ap/ieee802_11_he.c
-+++ b/src/ap/ieee802_11_he.c
-@@ -138,6 +138,13 @@ u8 * hostapd_eid_he_capab(struct hostapd_data *hapd, u8 *eid,
- 		os_memcpy(&cap->optional[mcs_nss_size],
- 			  mode->he_capab[opmode].ppet,  ppet_size);
- 
-+	if (hapd->iface->conf->he_phy_capab.he_ldpc)
-+		cap->he_phy_capab_info[HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX] |=
-+			HE_PHYCAP_LDPC_CODING_IN_PAYLOAD;
-+	else
-+		cap->he_phy_capab_info[HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX] &=
-+			~HE_PHYCAP_LDPC_CODING_IN_PAYLOAD;
-+
- 	if (hapd->iface->conf->he_phy_capab.he_su_beamformer)
- 		cap->he_phy_capab_info[HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX] |=
- 			HE_PHYCAP_SU_BEAMFORMER_CAPAB;
-diff --git a/src/common/ieee802_11_defs.h b/src/common/ieee802_11_defs.h
-index 65e125e83..62088bda6 100644
---- a/src/common/ieee802_11_defs.h
-+++ b/src/common/ieee802_11_defs.h
-@@ -2298,6 +2298,9 @@ struct ieee80211_spatial_reuse {
- #define HE_PHYCAP_CHANNEL_WIDTH_SET_160MHZ_IN_5G	((u8) BIT(3))
- #define HE_PHYCAP_CHANNEL_WIDTH_SET_80PLUS80MHZ_IN_5G	((u8) BIT(4))
- 
-+#define HE_PHYCAP_LDPC_CODING_IN_PAYLOAD_IDX	1
-+#define HE_PHYCAP_LDPC_CODING_IN_PAYLOAD	((u8) BIT(5))
-+
- #define HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX	3
- #define HE_PHYCAP_SU_BEAMFORMER_CAPAB		((u8) BIT(7))
- #define HE_PHYCAP_SU_BEAMFORMEE_CAPAB_IDX	4
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
similarity index 90%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch
copy to recipes-wifi/wpa-supplicant/files/patches/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
index 63101e0..4df0ba6 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
@@ -1,7 +1,7 @@
-From b49ce922afa13fe8ea5d847753dfb7641b70c9a4 Mon Sep 17 00:00:00 2001
+From ebbf23ac8c19224b34523e8b9820e32f0789fe11 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 12 Jan 2023 15:18:19 +0800
-Subject: [PATCH 12/15] hostapd: mtk: Add he_ldpc configuration
+Subject: [PATCH 13/16] hostapd: mtk: Add he_ldpc configuration
 
 ---
  hostapd/config_file.c        | 2 ++
@@ -13,7 +13,7 @@
  6 files changed, 19 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 10ea52518..4237a5cca 100644
+index 10ea525..4237a5c 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -3508,6 +3508,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -26,7 +26,7 @@
  		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
  		conf->he_op.he_bss_color_disabled = 0;
 diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
-index ea67aa100..e3a5eb365 100644
+index ea67aa1..e3a5eb3 100644
 --- a/hostapd/hostapd.conf
 +++ b/hostapd/hostapd.conf
 @@ -830,6 +830,11 @@ wmm_ac_vo_acm=0
@@ -42,7 +42,7 @@
  #he_bss_color=1
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 85ad5e444..b283de624 100644
+index 85ad5e4..b283de6 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -268,6 +268,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -54,7 +54,7 @@
  		HE_OPERATION_RTS_THRESHOLD_OFFSET;
  	/* Set default basic MCS/NSS set to single stream MCS 0-7 */
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9ac39619..b8b20a7aa 100644
+index a9ac396..b8b20a7 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -929,6 +929,7 @@ struct hostapd_bss_config {
@@ -66,7 +66,7 @@
  	bool he_su_beamformee;
  	bool he_mu_beamformer;
 diff --git a/src/ap/ieee802_11_he.c b/src/ap/ieee802_11_he.c
-index b5b7e5d46..f27aeb196 100644
+index b5b7e5d..f27aeb1 100644
 --- a/src/ap/ieee802_11_he.c
 +++ b/src/ap/ieee802_11_he.c
 @@ -138,6 +138,13 @@ u8 * hostapd_eid_he_capab(struct hostapd_data *hapd, u8 *eid,
@@ -84,7 +84,7 @@
  		cap->he_phy_capab_info[HE_PHYCAP_SU_BEAMFORMER_CAPAB_IDX] |=
  			HE_PHYCAP_SU_BEAMFORMER_CAPAB;
 diff --git a/src/common/ieee802_11_defs.h b/src/common/ieee802_11_defs.h
-index 65e125e83..62088bda6 100644
+index 65e125e..62088bd 100644
 --- a/src/common/ieee802_11_defs.h
 +++ b/src/common/ieee802_11_defs.h
 @@ -2298,6 +2298,9 @@ struct ieee80211_spatial_reuse {
@@ -98,5 +98,5 @@
  #define HE_PHYCAP_SU_BEAMFORMER_CAPAB		((u8) BIT(7))
  #define HE_PHYCAP_SU_BEAMFORMEE_CAPAB_IDX	4
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
deleted file mode 100644
index 1222510..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 52a1775318c9926a1dbf4f7c563e95b5be3c9bd6 Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Tue, 17 Jan 2023 13:25:18 +0800
-Subject: [PATCH 13/15] hostapd: mtk: Add the broadcast destination address of
- Probe Response frame on 6 GHz
-
-According to IEEE 802.11ax 26.17.2.3.2,
-if a 6 GHz AP receives a Probe Request frame and responds with a Probe Response frame,
-the Address 1 field of the Probe Response frame shall be set to the broadcast address,
-unless the AP is not indicating its actual SSID in the SSID element of its Beacon frames.
-
-Without this, hostapd fill the Address 1 feild of the Probe Response frame
-with the source address from Probe Request frame on 6 GHz.
-Fix this to use broadcast address instead.
-
-Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
----
- src/ap/beacon.c | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 1a26f11ff..f3ea5c277 100644
---- a/src/ap/beacon.c
-+++ b/src/ap/beacon.c
-@@ -1156,8 +1156,13 @@ void handle_probe_req(struct hostapd_data *hapd,
- 	wpa_msg_ctrl(hapd->msg_ctx, MSG_INFO, RX_PROBE_REQUEST "sa=" MACSTR
- 		     " signal=%d", MAC2STR(mgmt->sa), ssi_signal);
- 
--	resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
--				      &resp_len, false);
-+	if (is_6ghz_op_class(hapd->iconf->op_class) &&
-+	    is_broadcast_ether_addr(mgmt->da))
-+		resp = hostapd_gen_probe_resp(hapd, NULL, elems.p2p != NULL,
-+					      &resp_len, true);
-+	else
-+		resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
-+					      &resp_len, false);
- 	if (resp == NULL)
- 		return;
- 
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
similarity index 89%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
copy to recipes-wifi/wpa-supplicant/files/patches/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
index 1222510..f0d25c6 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
@@ -1,7 +1,7 @@
-From 52a1775318c9926a1dbf4f7c563e95b5be3c9bd6 Mon Sep 17 00:00:00 2001
+From bb5cb086162828392a04820063ad7997d8ae26d7 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 17 Jan 2023 13:25:18 +0800
-Subject: [PATCH 13/15] hostapd: mtk: Add the broadcast destination address of
+Subject: [PATCH 14/16] hostapd: mtk: Add the broadcast destination address of
  Probe Response frame on 6 GHz
 
 According to IEEE 802.11ax 26.17.2.3.2,
@@ -19,7 +19,7 @@
  1 file changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 1a26f11ff..f3ea5c277 100644
+index 1a26f11..f3ea5c2 100644
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
 @@ -1156,8 +1156,13 @@ void handle_probe_req(struct hostapd_data *hapd,
@@ -39,5 +39,5 @@
  		return;
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
deleted file mode 100644
index 3689f74..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 7d741c99f2e211abe70593ff6e8265633bed0d8a Mon Sep 17 00:00:00 2001
-From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
-Date: Tue, 24 Jan 2023 19:06:44 +0800
-Subject: [PATCH 14/15] hostapd: mtk: Add vendor command attribute for RTS BW
- signaling.
-
-Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
----
- src/common/mtk_vendor.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9e2..fb12895ce 100644
---- a/src/common/mtk_vendor.h
-+++ b/src/common/mtk_vendor.h
-@@ -169,6 +169,7 @@ enum mtk_vendor_attr_wireless_ctrl {
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_RTS_SIGTA,
- 
- 	/* keep last */
- 	NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
--- 
-2.25.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch
deleted file mode 100644
index 642c625..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 619075bb430c908c61a818c45e36f1ca76020741 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 13 Feb 2023 11:03:53 +0800
-Subject: [PATCH 15/15] hostapd: mtk: 6G band does not require DFS
-
----
- src/ap/dfs.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index 1c3f6785b..4b1e64246 100644
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -1506,6 +1506,7 @@ int hostapd_is_dfs_required(struct hostapd_iface *iface)
- 	if ((!(iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD) &&
- 	     !iface->conf->ieee80211h) ||
- 	    !iface->current_mode ||
-+	    is_6ghz_freq(iface->freq) ||
- 	    iface->current_mode->mode != HOSTAPD_MODE_IEEE80211A)
- 		return 0;
- 
--- 
-2.25.1
-
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
similarity index 79%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
copy to recipes-wifi/wpa-supplicant/files/patches/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
index 3689f74..5fcd0c5 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
@@ -1,7 +1,7 @@
-From 7d741c99f2e211abe70593ff6e8265633bed0d8a Mon Sep 17 00:00:00 2001
+From 1db373190399a907b27141c199841aeafd4643da Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Tue, 24 Jan 2023 19:06:44 +0800
-Subject: [PATCH 14/15] hostapd: mtk: Add vendor command attribute for RTS BW
+Subject: [PATCH 15/16] hostapd: mtk: Add vendor command attribute for RTS BW
  signaling.
 
 Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9e2..fb12895ce 100644
+index 0999ea9..fb12895 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -169,6 +169,7 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -22,5 +22,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
similarity index 76%
copy from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch
copy to recipes-wifi/wpa-supplicant/files/patches/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
index 642c625..33fea78 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
@@ -1,14 +1,14 @@
-From 619075bb430c908c61a818c45e36f1ca76020741 Mon Sep 17 00:00:00 2001
+From efa1d271d28c84b8ca77ffc3ca7cb75e727088a0 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 13 Feb 2023 11:03:53 +0800
-Subject: [PATCH 15/15] hostapd: mtk: 6G band does not require DFS
+Subject: [PATCH 16/16] hostapd: mtk: 6G band does not require DFS
 
 ---
  src/ap/dfs.c | 1 +
  1 file changed, 1 insertion(+)
 
 diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index 1c3f6785b..4b1e64246 100644
+index 1c3f678..4b1e642 100644
 --- a/src/ap/dfs.c
 +++ b/src/ap/dfs.c
 @@ -1506,6 +1506,7 @@ int hostapd_is_dfs_required(struct hostapd_iface *iface)
@@ -20,5 +20,5 @@
  		return 0;
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
new file mode 100644
index 0000000..265c37a
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
@@ -0,0 +1,46 @@
+From f6bfd9a4a6c0d08e0dec9311873c9e863a07c9a8 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 11:01:18 +0800
+Subject: [PATCH] hostapd: mtk: Fix sending wrong VHT operation IE in CSA while
+ using ZWDFS
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ src/ap/dfs.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 4b1e642..307a4e1 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1110,6 +1110,14 @@ static int
+ hostapd_dfs_start_channel_switch_background(struct hostapd_iface *iface)
+ {
+ 	u8 current_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
++	int ret;
++
++	ret = hostapd_dfs_request_channel_switch(iface, iface->radar_background.channel,
++						 iface->radar_background.freq,
++						 iface->radar_background.secondary_channel,
++						 current_vht_oper_chwidth,
++						 iface->radar_background.centr_freq_seg0_idx,
++						 iface->radar_background.centr_freq_seg1_idx);
+ 
+ 	iface->conf->channel = iface->radar_background.channel;
+ 	iface->freq = iface->radar_background.freq;
+@@ -1122,11 +1130,7 @@ hostapd_dfs_start_channel_switch_background(struct hostapd_iface *iface)
+ 
+ 	hostpad_dfs_update_background_chain(iface);
+ 
+-	return hostapd_dfs_request_channel_switch(
+-		iface, iface->conf->channel, iface->freq,
+-		iface->conf->secondary_channel, current_vht_oper_chwidth,
+-		hostapd_get_oper_centr_freq_seg0_idx(iface->conf),
+-		hostapd_get_oper_centr_freq_seg1_idx(iface->conf));
++	return ret;
+ }
+ 
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
new file mode 100644
index 0000000..db3c813
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
@@ -0,0 +1,189 @@
+From 3337e7b4f75a66e53e1320e49deba2b58a8a80b0 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 10:51:47 +0800
+Subject: [PATCH 18/19] hostapd: mtk: Add sta-assisted DFS state update
+ mechanism
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ src/ap/dfs.c                       | 20 ++++++++++++++++++++
+ src/ap/dfs.h                       |  3 +++
+ src/ap/drv_callbacks.c             | 28 ++++++++++++++++++++++++++++
+ src/common/wpa_ctrl.h              |  1 +
+ src/drivers/driver.h               | 14 ++++++++++++++
+ src/drivers/driver_nl80211_event.c |  6 ++++++
+ src/drivers/nl80211_copy.h         |  6 ++++++
+ 7 files changed, 78 insertions(+)
+
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 307a4e1..d082fe0 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1503,6 +1503,26 @@ int hostapd_dfs_nop_finished(struct hostapd_iface *iface, int freq,
+ }
+ 
+ 
++int hostapd_dfs_sta_update_state(struct hostapd_iface *iface, int freq,
++				 int ht_enabled, int chan_offset, int chan_width,
++				 int cf1, int cf2, u32 state)
++{
++	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_STA_UPDATE
++		"freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d state=%s",
++		freq, ht_enabled, chan_offset, chan_width, cf1, cf2,
++		(state == HOSTAPD_CHAN_DFS_AVAILABLE) ? "available" : "usable");
++
++	/* Proceed only if DFS is not offloaded to the driver */
++	if (iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD)
++		return 0;
++
++	set_dfs_state(iface, freq, ht_enabled, chan_offset, chan_width,
++		      cf1, cf2, state);
++
++	return 0;
++}
++
++
+ int hostapd_is_dfs_required(struct hostapd_iface *iface)
+ {
+ 	int n_chans, n_chans1, start_chan_idx, start_chan_idx1, res;
+diff --git a/src/ap/dfs.h b/src/ap/dfs.h
+index c2556d2..25ba29c 100644
+--- a/src/ap/dfs.h
++++ b/src/ap/dfs.h
+@@ -30,6 +30,9 @@ int hostapd_dfs_radar_detected(struct hostapd_iface *iface, int freq,
+ int hostapd_dfs_nop_finished(struct hostapd_iface *iface, int freq,
+ 			     int ht_enabled,
+ 			     int chan_offset, int chan_width, int cf1, int cf2);
++int hostapd_dfs_sta_update_state(struct hostapd_iface *iface, int freq,
++				 int ht_enabled, int chan_offset, int chan_width,
++				 int cf1, int cf2, u32 state);
+ int hostapd_is_dfs_required(struct hostapd_iface *iface);
+ int hostapd_is_dfs_chan_available(struct hostapd_iface *iface);
+ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+diff --git a/src/ap/drv_callbacks.c b/src/ap/drv_callbacks.c
+index 09783cb..275f6b3 100644
+--- a/src/ap/drv_callbacks.c
++++ b/src/ap/drv_callbacks.c
+@@ -1790,6 +1790,24 @@ static void hostapd_event_dfs_cac_started(struct hostapd_data *hapd,
+ 			      radar->cf1, radar->cf2);
+ }
+ 
++static void hostapd_event_dfs_sta_cac_skipped(struct hostapd_data *hapd,
++					      struct dfs_event *radar)
++{
++	wpa_printf(MSG_DEBUG, "DFS CAC skipped (by STA) on %d MHz", radar->freq);
++	hostapd_dfs_sta_update_state(hapd->iface, radar->freq, radar->ht_enabled,
++				     radar->chan_offset, radar->chan_width,
++				     radar->cf1, radar->cf2, HOSTAPD_CHAN_DFS_AVAILABLE);
++}
++
++static void hostapd_event_dfs_sta_cac_expired(struct hostapd_data *hapd,
++					      struct dfs_event *radar)
++{
++	wpa_printf(MSG_DEBUG, "DFS CAC expired (by STA) on %d MHz", radar->freq);
++	hostapd_dfs_sta_update_state(hapd->iface, radar->freq, radar->ht_enabled,
++				     radar->chan_offset, radar->chan_width,
++				     radar->cf1, radar->cf2, HOSTAPD_CHAN_DFS_USABLE);
++}
++
+ #endif /* NEED_AP_MLME */
+ 
+ 
+@@ -2064,6 +2082,16 @@ void hostapd_wpa_event(void *ctx, enum wpa_event_type event,
+ 			break;
+ 		hostapd_event_dfs_nop_finished(hapd, &data->dfs_event);
+ 		break;
++	case EVENT_DFS_STA_CAC_SKIPPED:
++		if (!data)
++			break;
++		hostapd_event_dfs_sta_cac_skipped(hapd, &data->dfs_event);
++		break;
++	case EVENT_DFS_STA_CAC_EXPIRED:
++		if (!data)
++			break;
++		hostapd_event_dfs_sta_cac_expired(hapd, &data->dfs_event);
++		break;
+ 	case EVENT_CHANNEL_LIST_CHANGED:
+ 		/* channel list changed (regulatory?), update channel list */
+ 		/* TODO: check this. hostapd_get_hw_features() initializes
+diff --git a/src/common/wpa_ctrl.h b/src/common/wpa_ctrl.h
+index 3435084..79c8a82 100644
+--- a/src/common/wpa_ctrl.h
++++ b/src/common/wpa_ctrl.h
+@@ -360,6 +360,7 @@ extern "C" {
+ #define DFS_EVENT_CAC_COMPLETED "DFS-CAC-COMPLETED "
+ #define DFS_EVENT_NOP_FINISHED "DFS-NOP-FINISHED "
+ #define DFS_EVENT_PRE_CAC_EXPIRED "DFS-PRE-CAC-EXPIRED "
++#define DFS_EVENT_STA_UPDATE "DFS-STA-UPDATE "
+ 
+ #define AP_CSA_FINISHED "AP-CSA-FINISHED "
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 265d86d..b5de0e6 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -5317,6 +5317,20 @@ enum wpa_event_type {
+ 	 * EVENT_CCA_NOTIFY - Notification that CCA has completed
+ 	 */
+ 	EVENT_CCA_NOTIFY,
++
++	/**
++	 * EVENT_DFS_STA_CAC_SKIPPED - Notification that CAC has been skipped
++	 *
++	 * The channel in the notification is now marked as available.
++	 */
++	EVENT_DFS_STA_CAC_SKIPPED,
++
++	/**
++	 * EVENT_DFS_STA_CAC_EXPIRED - Notification that CAC has expired
++	 *
++	 * The channel in the notification is now marked as usable.
++	 */
++	EVENT_DFS_STA_CAC_EXPIRED,
+ };
+ 
+ 
+diff --git a/src/drivers/driver_nl80211_event.c b/src/drivers/driver_nl80211_event.c
+index 73bb7a4..ee922ac 100644
+--- a/src/drivers/driver_nl80211_event.c
++++ b/src/drivers/driver_nl80211_event.c
+@@ -1854,6 +1854,12 @@ static void nl80211_radar_event(struct wpa_driver_nl80211_data *drv,
+ 	case NL80211_RADAR_CAC_STARTED:
+ 		wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_STARTED, &data);
+ 		break;
++	case NL80211_RADAR_STA_CAC_SKIPPED:
++		wpa_supplicant_event(drv->ctx, EVENT_DFS_STA_CAC_SKIPPED, &data);
++		break;
++	case NL80211_RADAR_STA_CAC_EXPIRED:
++		wpa_supplicant_event(drv->ctx, EVENT_DFS_STA_CAC_EXPIRED, &data);
++		break;
+ 	default:
+ 		wpa_printf(MSG_DEBUG, "nl80211: Unknown radar event %d "
+ 			   "received", event_type);
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index c4bf3ad..0937752 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -6431,6 +6431,10 @@ enum nl80211_smps_mode {
+  *	applicable for ETSI dfs domain where pre-CAC is valid for ever.
+  * @NL80211_RADAR_CAC_STARTED: Channel Availability Check has been started,
+  *	should be generated by HW if NL80211_EXT_FEATURE_DFS_OFFLOAD is enabled.
++ * @NL80211_RADAR_STA_CAC_SKIPPED: STA set the DFS state to available
++ *	when receiving CSA/assoc resp
++ * @NL80211_RADAR_STA_CAC_EXPIRED: STA set the DFS state to usable
++ *	when STA is disconnected or leaving the channel
+  */
+ enum nl80211_radar_event {
+ 	NL80211_RADAR_DETECTED,
+@@ -6439,6 +6443,8 @@ enum nl80211_radar_event {
+ 	NL80211_RADAR_NOP_FINISHED,
+ 	NL80211_RADAR_PRE_CAC_EXPIRED,
+ 	NL80211_RADAR_CAC_STARTED,
++	NL80211_RADAR_STA_CAC_SKIPPED,
++	NL80211_RADAR_STA_CAC_EXPIRED,
+ };
+ 
+ /**
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
new file mode 100644
index 0000000..8340fd9
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
@@ -0,0 +1,43 @@
+From 83ab1a9cc51225095842d3c62bf75cf4efe63075 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Feb 2023 16:58:20 +0800
+Subject: [PATCH] hostapd: mtk: Fix auto ht issue when switching to DFS channel
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 0ad8451..407790f 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -2698,6 +2698,12 @@ static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
+ 		break;
+ 	}
+ 
++	if (os_strstr(pos, " auto-ht")) {
++		settings.freq_params.ht_enabled = iface->conf->ieee80211n;
++		settings.freq_params.vht_enabled = iface->conf->ieee80211ac;
++		settings.freq_params.he_enabled = iface->conf->ieee80211ax;
++	}
++
+ 	if (settings.freq_params.center_freq1)
+ 		dfs_range += hostapd_is_dfs_overlap(
+ 			iface, bandwidth, settings.freq_params.center_freq1);
+@@ -2735,12 +2741,6 @@ static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
+ 		return 0;
+ 	}
+ 
+-	if (os_strstr(pos, " auto-ht")) {
+-		settings.freq_params.ht_enabled = iface->conf->ieee80211n;
+-		settings.freq_params.vht_enabled = iface->conf->ieee80211ac;
+-		settings.freq_params.he_enabled = iface->conf->ieee80211ax;
+-	}
+-
+ 	for (i = 0; i < iface->num_bss; i++) {
+ 
+ 		/* Save CHAN_SWITCH VHT, HE, and EHT config */
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/patches.inc b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
index b2f59b9..872f470 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
@@ -71,10 +71,14 @@
     file://mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch \
     file://mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch \
     file://mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch \
-    file://mtk-0010-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch \
-    file://mtk-0011-hostapd-mtk-Add-amsdu-set-get-ctrl.patch \
-    file://mtk-0012-hostapd-mtk-Add-he_ldpc-configuration.patch \
-    file://mtk-0013-hostapd-mtk-Add-the-broadcast-destination-address-of.patch \
-    file://mtk-0014-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch \
-    file://mtk-0015-hostapd-mtk-6G-band-does-not-require-DFS.patch \
+    file://mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch \
+    file://mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch \
+    file://mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch \
+    file://mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch \
+    file://mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch \
+    file://mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch \
+    file://mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch \
+    file://mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch \
+    file://mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch \
+    file://mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch \
     "