[rdk-b][common][wifi][Refactor wifi bsp bb to prepare wifi7 support]
[Description]
Refactor wifi bsp bb to prepare wifi7 support
[Release-log]
N/A
diff --git a/conf/machine/filogic.conf b/conf/machine/filogic.conf
index 363728a..fdef72d 100644
--- a/conf/machine/filogic.conf
+++ b/conf/machine/filogic.conf
@@ -43,12 +43,6 @@
MACHINEOVERRIDES .= ":broadband:filogic"
-PREFERRED_VERSION_linux-libc-headers = "5.4.%"
-PREFERRED_PROVIDER_hal-wifi = "hal-wifi-cfg80211"
-PREFERRED_VERSION_iw_filogic = "5.%"
-PREFERRED_VERSION_hostapd = "2.10"
-PREFERRED_VERSION_wpa-supplicant = "2.10"
-
IMAGE_FSTYPES ="${@bb.utils.contains('DISTRO_FEATURES','kernel_in_ubi',' squashfs-xz',' ubi',d)}"
IMAGE_FSTYPES_DEBUGFS = ""
IMAGE_GEN_DEBUGFS = "0"
diff --git a/recipes-wifi/hostapd/files/patches-2.11/001-wolfssl-init-RNG-with-ECC-key.patch b/recipes-wifi/hostapd/files/patches-2.11/001-wolfssl-init-RNG-with-ECC-key.patch
new file mode 100644
index 0000000..269dcaa
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/001-wolfssl-init-RNG-with-ECC-key.patch
@@ -0,0 +1,43 @@
+From 21ce83b4ae2b9563175fdb4fc4312096cc399cf8 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Wed, 5 May 2021 00:44:34 +0200
+Subject: [PATCH] wolfssl: add RNG to EC key
+
+Since upstream commit 6467de5a8840 ("Randomize z ordinates in
+scalar mult when timing resistant") WolfSSL requires a RNG for
+the EC key when built hardened which is the default.
+
+Set the RNG for the EC key to fix connections for OWE clients.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ src/crypto/crypto_wolfssl.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/src/crypto/crypto_wolfssl.c
++++ b/src/crypto/crypto_wolfssl.c
+@@ -1340,6 +1340,7 @@ int ecc_projective_add_point(ecc_point *
+
+ struct crypto_ec {
+ ecc_key key;
++ WC_RNG rng;
+ mp_int a;
+ mp_int prime;
+ mp_int order;
+@@ -1394,6 +1395,8 @@ struct crypto_ec * crypto_ec_init(int gr
+ return NULL;
+
+ if (wc_ecc_init(&e->key) != 0 ||
++ wc_InitRng(&e->rng) != 0 ||
++ wc_ecc_set_rng(&e->key, &e->rng) != 0 ||
+ wc_ecc_set_curve(&e->key, 0, curve_id) != 0 ||
+ mp_init(&e->a) != MP_OKAY ||
+ mp_init(&e->prime) != MP_OKAY ||
+@@ -1425,6 +1428,7 @@ void crypto_ec_deinit(struct crypto_ec*
+ mp_clear(&e->order);
+ mp_clear(&e->prime);
+ mp_clear(&e->a);
++ wc_FreeRng(&e->rng);
+ wc_ecc_free(&e->key);
+ os_free(e);
+ }
diff --git a/recipes-wifi/hostapd/files/patches-2.11/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch b/recipes-wifi/hostapd/files/patches-2.11/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
new file mode 100644
index 0000000..6bc48ab
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
@@ -0,0 +1,106 @@
+From 8de8cd8380af0c43d4fde67a668d79ef73b26b26 Mon Sep 17 00:00:00 2001
+From: Peter Oh <peter.oh@bowerswilkins.com>
+Date: Tue, 30 Jun 2020 14:18:58 +0200
+Subject: [PATCH 10/19] mesh: Allow DFS channels to be selected if dfs is
+ enabled
+
+Note: DFS is assumed to be usable if a country code has been set
+
+Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
+Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
+---
+ wpa_supplicant/wpa_supplicant.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -2436,7 +2436,7 @@ static int drv_supports_vht(struct wpa_s
+ }
+
+
+-static bool ibss_mesh_is_80mhz_avail(int channel, struct hostapd_hw_modes *mode)
++static bool ibss_mesh_is_80mhz_avail(int channel, struct hostapd_hw_modes *mode, bool dfs_enabled)
+ {
+ int i;
+
+@@ -2445,7 +2445,10 @@ static bool ibss_mesh_is_80mhz_avail(int
+
+ chan = hw_get_channel_chan(mode, i, NULL);
+ if (!chan ||
+- chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
++ chan->flag & HOSTAPD_CHAN_DISABLED)
++ return false;
++
++ if (!dfs_enabled && chan->flag & (HOSTAPD_CHAN_RADAR | HOSTAPD_CHAN_NO_IR))
+ return false;
+ }
+
+@@ -2474,6 +2477,8 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ int chwidth, seg0, seg1;
+ u32 vht_caps = 0;
+ bool is_24ghz, is_6ghz;
++ bool dfs_enabled = wpa_s->conf->country[0] &&
++ (wpa_s->drv_flags & WPA_DRIVER_FLAGS_RADAR);
+
+ freq->freq = ssid->frequency;
+
+@@ -2570,8 +2575,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ return;
+
+ /* Check primary channel flags */
+- if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
++ if (pri_chan->flag & HOSTAPD_CHAN_DISABLED)
+ return;
++ if (pri_chan->flag & (HOSTAPD_CHAN_RADAR | HOSTAPD_CHAN_NO_IR))
++ if (!dfs_enabled)
++ return;
+
+ freq->channel = pri_chan->chan;
+
+@@ -2604,8 +2612,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ return;
+
+ /* Check secondary channel flags */
+- if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
++ if (sec_chan->flag & HOSTAPD_CHAN_DISABLED)
+ return;
++ if (sec_chan->flag & (HOSTAPD_CHAN_RADAR | HOSTAPD_CHAN_NO_IR))
++ if (!dfs_enabled)
++ return;
+
+ if (ht40 == -1) {
+ if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
+@@ -2694,7 +2705,7 @@ skip_to_6ghz:
+ return;
+
+ /* Back to HT configuration if channel not usable */
+- if (!ibss_mesh_is_80mhz_avail(channel, mode))
++ if (!ibss_mesh_is_80mhz_avail(channel, mode, dfs_enabled))
+ return;
+
+ chwidth = CONF_OPER_CHWIDTH_80MHZ;
+@@ -2708,7 +2719,7 @@ skip_to_6ghz:
+ * above; check the remaining four 20 MHz channels for the total
+ * of 160 MHz bandwidth.
+ */
+- if (!ibss_mesh_is_80mhz_avail(channel + 16, mode))
++ if (!ibss_mesh_is_80mhz_avail(channel + 16, mode, dfs_enabled))
+ return;
+
+ for (j = 0; j < ARRAY_SIZE(bw160); j++) {
+@@ -2738,10 +2749,12 @@ skip_to_6ghz:
+ if (!chan)
+ continue;
+
+- if (chan->flag & (HOSTAPD_CHAN_DISABLED |
+- HOSTAPD_CHAN_NO_IR |
+- HOSTAPD_CHAN_RADAR))
++ if (chan->flag & HOSTAPD_CHAN_DISABLED)
+ continue;
++ if (chan->flag & (HOSTAPD_CHAN_RADAR |
++ HOSTAPD_CHAN_NO_IR))
++ if (!dfs_enabled)
++ continue;
+
+ /* Found a suitable second segment for 80+80 */
+ chwidth = CONF_OPER_CHWIDTH_80P80MHZ;
diff --git a/recipes-wifi/hostapd/files/patches-2.11/011-mesh-use-deterministic-channel-on-channel-switch.patch b/recipes-wifi/hostapd/files/patches-2.11/011-mesh-use-deterministic-channel-on-channel-switch.patch
new file mode 100644
index 0000000..32a4479
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/011-mesh-use-deterministic-channel-on-channel-switch.patch
@@ -0,0 +1,81 @@
+From fc8ea40f6130ac18d9c66797de2cf1d5af55d496 Mon Sep 17 00:00:00 2001
+From: Markus Theil <markus.theil@tu-ilmenau.de>
+Date: Tue, 30 Jun 2020 14:19:07 +0200
+Subject: [PATCH 19/19] mesh: use deterministic channel on channel switch
+
+This patch uses a deterministic channel on DFS channel switch
+in mesh networks. Otherwise, when switching to a usable but not
+available channel, no CSA can be sent and a random channel is choosen
+without notification of other nodes. It is then quite likely, that
+the mesh network gets disconnected.
+
+Fix this by using a deterministic number, based on the sha256 hash
+of the mesh ID, in order to use at least a different number in each
+mesh network.
+
+Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
+---
+ src/ap/dfs.c | 20 +++++++++++++++++++-
+ src/drivers/driver_nl80211.c | 4 ++++
+ 2 files changed, 23 insertions(+), 1 deletion(-)
+
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -17,6 +17,7 @@
+ #include "ap_drv_ops.h"
+ #include "drivers/driver.h"
+ #include "dfs.h"
++#include "crypto/crypto.h"
+
+
+ enum dfs_channel_type {
+@@ -515,9 +516,14 @@ dfs_get_valid_channel(struct hostapd_ifa
+ int num_available_chandefs;
+ int chan_idx, chan_idx2;
+ int sec_chan_idx_80p80 = -1;
++ bool is_mesh = false;
+ int i;
+ u32 _rand;
+
++#ifdef CONFIG_MESH
++ is_mesh = iface->mconf;
++#endif
++
+ wpa_printf(MSG_DEBUG, "DFS: Selecting random channel");
+ *secondary_channel = 0;
+ *oper_centr_freq_seg0_idx = 0;
+@@ -537,8 +543,20 @@ dfs_get_valid_channel(struct hostapd_ifa
+ if (num_available_chandefs == 0)
+ return NULL;
+
+- if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
++ /* try to use deterministic channel in mesh, so that both sides
++ * have a chance to switch to the same channel */
++ if (is_mesh) {
++#ifdef CONFIG_MESH
++ u64 hash[4];
++ const u8 *meshid[1] = { &iface->mconf->meshid[0] };
++ const size_t meshid_len = iface->mconf->meshid_len;
++
++ sha256_vector(1, meshid, &meshid_len, (u8 *)&hash[0]);
++ _rand = hash[0] + hash[1] + hash[2] + hash[3];
++#endif
++ } else if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
+ return NULL;
++
+ chan_idx = _rand % num_available_chandefs;
+ dfs_find_channel(iface, &chan, chan_idx, type);
+ if (!chan) {
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -9948,6 +9948,10 @@ static int nl80211_switch_channel(void *
+ if (ret)
+ goto error;
+
++ if (drv->nlmode == NL80211_IFTYPE_MESH_POINT) {
++ nla_put_flag(msg, NL80211_ATTR_HANDLE_DFS);
++ }
++
+ /* beacon_csa params */
+ beacon_csa = nla_nest_start(msg, NL80211_ATTR_CSA_IES);
+ if (!beacon_csa)
diff --git a/recipes-wifi/hostapd/files/patches-2.11/021-fix-sta-add-after-previous-connection.patch b/recipes-wifi/hostapd/files/patches-2.11/021-fix-sta-add-after-previous-connection.patch
new file mode 100644
index 0000000..80b23bd
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/021-fix-sta-add-after-previous-connection.patch
@@ -0,0 +1,26 @@
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -4963,6 +4963,13 @@ static int add_associated_sta(struct hos
+ * drivers to accept the STA parameter configuration. Since this is
+ * after a new FT-over-DS exchange, a new TK has been derived, so key
+ * reinstallation is not a concern for this case.
++ *
++ * If the STA was associated and authorized earlier, but came for a new
++ * connection (!added_unassoc + !reassoc), remove the existing STA entry
++ * so that it can be re-added. This case is rarely seen when the AP could
++ * not receive the deauth/disassoc frame from the STA. And the STA comes
++ * back with new connection within a short period or before the inactive
++ * STA entry is removed from the list.
+ */
+ wpa_printf(MSG_DEBUG, "Add associated STA " MACSTR
+ " (added_unassoc=%d auth_alg=%u ft_over_ds=%u reassoc=%d authorized=%d ft_tk=%d fils_tk=%d)",
+@@ -4976,7 +4983,8 @@ static int add_associated_sta(struct hos
+ (!(sta->flags & WLAN_STA_AUTHORIZED) ||
+ (reassoc && sta->ft_over_ds && sta->auth_alg == WLAN_AUTH_FT) ||
+ (!wpa_auth_sta_ft_tk_already_set(sta->wpa_sm) &&
+- !wpa_auth_sta_fils_tk_already_set(sta->wpa_sm)))) {
++ !wpa_auth_sta_fils_tk_already_set(sta->wpa_sm)) ||
++ (!reassoc && (sta->flags & WLAN_STA_AUTHORIZED)))) {
+ hostapd_drv_sta_remove(hapd, sta->addr);
+ wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED);
+ set = 0;
diff --git a/recipes-wifi/hostapd/files/patches-2.11/022-hostapd-fix-use-of-uninitialized-stack-variables.patch b/recipes-wifi/hostapd/files/patches-2.11/022-hostapd-fix-use-of-uninitialized-stack-variables.patch
new file mode 100644
index 0000000..25801da
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/022-hostapd-fix-use-of-uninitialized-stack-variables.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 8 Jul 2021 16:33:03 +0200
+Subject: [PATCH] hostapd: fix use of uninitialized stack variables
+
+When a CSA is performed on an 80 MHz channel, hostapd_change_config_freq
+unconditionally calls hostapd_set_oper_centr_freq_seg0/1_idx with seg0/1
+filled by ieee80211_freq_to_chan.
+However, if ieee80211_freq_to_chan fails (because the freq is 0 or invalid),
+seg0/1 remains uninitialized and filled with stack garbage, causing errors
+such as "hostapd: 80 MHz: center segment 1 configured"
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -3453,7 +3453,7 @@ static int hostapd_change_config_freq(st
+ struct hostapd_freq_params *old_params)
+ {
+ int channel;
+- u8 seg0, seg1;
++ u8 seg0 = 0, seg1 = 0;
+ struct hostapd_hw_modes *mode;
+
+ if (!params->channel) {
diff --git a/recipes-wifi/hostapd/files/patches-2.11/023-ndisc_snoop-call-dl_list_del-before-freeing-ipv6-add.patch b/recipes-wifi/hostapd/files/patches-2.11/023-ndisc_snoop-call-dl_list_del-before-freeing-ipv6-add.patch
new file mode 100644
index 0000000..9ff9b23
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/023-ndisc_snoop-call-dl_list_del-before-freeing-ipv6-add.patch
@@ -0,0 +1,19 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 28 Jul 2021 05:43:29 +0200
+Subject: [PATCH] ndisc_snoop: call dl_list_del before freeing ipv6 addresses
+
+Fixes a segmentation fault on sta disconnect
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/ap/ndisc_snoop.c
++++ b/src/ap/ndisc_snoop.c
+@@ -61,6 +61,7 @@ void sta_ip6addr_del(struct hostapd_data
+ dl_list_for_each_safe(ip6addr, prev, &sta->ip6addr, struct ip6addr,
+ list) {
+ hostapd_drv_br_delete_ip_neigh(hapd, 6, (u8 *) &ip6addr->addr);
++ dl_list_del(&ip6addr->list);
+ os_free(ip6addr);
+ }
+ }
diff --git a/recipes-wifi/hostapd/files/patches-2.11/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch b/recipes-wifi/hostapd/files/patches-2.11/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
new file mode 100644
index 0000000..988fbbc
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
@@ -0,0 +1,275 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 28 Jul 2021 05:49:46 +0200
+Subject: [PATCH] driver_nl80211: rewrite neigh code to not depend on
+ libnl3-route
+
+Removes an unnecessary dependency and also makes the code smaller
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -16,9 +16,6 @@
+ #include <net/if.h>
+ #include <netlink/genl/genl.h>
+ #include <netlink/genl/ctrl.h>
+-#ifdef CONFIG_LIBNL3_ROUTE
+-#include <netlink/route/neighbour.h>
+-#endif /* CONFIG_LIBNL3_ROUTE */
+ #include <linux/rtnetlink.h>
+ #include <netpacket/packet.h>
+ #include <linux/errqueue.h>
+@@ -5344,26 +5341,29 @@ fail:
+
+ static void rtnl_neigh_delete_fdb_entry(struct i802_bss *bss, const u8 *addr)
+ {
+-#ifdef CONFIG_LIBNL3_ROUTE
+ struct wpa_driver_nl80211_data *drv = bss->drv;
+- struct rtnl_neigh *rn;
+- struct nl_addr *nl_addr;
++ struct ndmsg nhdr = {
++ .ndm_state = NUD_PERMANENT,
++ .ndm_ifindex = bss->ifindex,
++ .ndm_family = AF_BRIDGE,
++ };
++ struct nl_msg *msg;
+ int err;
+
+- rn = rtnl_neigh_alloc();
+- if (!rn)
++ msg = nlmsg_alloc_simple(RTM_DELNEIGH, NLM_F_CREATE);
++ if (!msg)
+ return;
+
+- rtnl_neigh_set_family(rn, AF_BRIDGE);
+- rtnl_neigh_set_ifindex(rn, bss->ifindex);
+- nl_addr = nl_addr_build(AF_BRIDGE, (void *) addr, ETH_ALEN);
+- if (!nl_addr) {
+- rtnl_neigh_put(rn);
+- return;
+- }
+- rtnl_neigh_set_lladdr(rn, nl_addr);
++ if (nlmsg_append(msg, &nhdr, sizeof(nhdr), NLMSG_ALIGNTO) < 0)
++ goto errout;
++
++ if (nla_put(msg, NDA_LLADDR, ETH_ALEN, (void *)addr))
++ goto errout;
++
++ if (nl_send_auto_complete(drv->rtnl_sk, msg) < 0)
++ goto errout;
+
+- err = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
++ err = nl_wait_for_ack(drv->rtnl_sk);
+ if (err < 0) {
+ wpa_printf(MSG_DEBUG, "nl80211: bridge FDB entry delete for "
+ MACSTR " ifindex=%d failed: %s", MAC2STR(addr),
+@@ -5373,9 +5373,8 @@ static void rtnl_neigh_delete_fdb_entry(
+ MACSTR, MAC2STR(addr));
+ }
+
+- nl_addr_put(nl_addr);
+- rtnl_neigh_put(rn);
+-#endif /* CONFIG_LIBNL3_ROUTE */
++errout:
++ nlmsg_free(msg);
+ }
+
+
+@@ -7763,7 +7762,6 @@ static void *i802_init(struct hostapd_da
+ (params->num_bridge == 0 || !params->bridge[0]))
+ add_ifidx(drv, br_ifindex, drv->ifindex);
+
+-#ifdef CONFIG_LIBNL3_ROUTE
+ if (bss->added_if_into_bridge || bss->already_in_bridge) {
+ int err;
+
+@@ -7780,7 +7778,6 @@ static void *i802_init(struct hostapd_da
+ goto failed;
+ }
+ }
+-#endif /* CONFIG_LIBNL3_ROUTE */
+
+ if (drv->capa.flags2 & WPA_DRIVER_FLAGS2_CONTROL_PORT_RX) {
+ wpa_printf(MSG_DEBUG,
+@@ -10813,13 +10810,14 @@ static int wpa_driver_br_add_ip_neigh(vo
+ const u8 *ipaddr, int prefixlen,
+ const u8 *addr)
+ {
+-#ifdef CONFIG_LIBNL3_ROUTE
+ struct i802_bss *bss = priv;
+ struct wpa_driver_nl80211_data *drv = bss->drv;
+- struct rtnl_neigh *rn;
+- struct nl_addr *nl_ipaddr = NULL;
+- struct nl_addr *nl_lladdr = NULL;
+- int family, addrsize;
++ struct ndmsg nhdr = {
++ .ndm_state = NUD_PERMANENT,
++ .ndm_ifindex = bss->br_ifindex,
++ };
++ struct nl_msg *msg;
++ int addrsize;
+ int res;
+
+ if (!ipaddr || prefixlen == 0 || !addr)
+@@ -10838,85 +10836,66 @@ static int wpa_driver_br_add_ip_neigh(vo
+ }
+
+ if (version == 4) {
+- family = AF_INET;
++ nhdr.ndm_family = AF_INET;
+ addrsize = 4;
+ } else if (version == 6) {
+- family = AF_INET6;
++ nhdr.ndm_family = AF_INET6;
+ addrsize = 16;
+ } else {
+ return -EINVAL;
+ }
+
+- rn = rtnl_neigh_alloc();
+- if (rn == NULL)
++ msg = nlmsg_alloc_simple(RTM_NEWNEIGH, NLM_F_CREATE);
++ if (!msg)
+ return -ENOMEM;
+
+- /* set the destination ip address for neigh */
+- nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
+- if (nl_ipaddr == NULL) {
+- wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
+- res = -ENOMEM;
++ res = -ENOMEM;
++ if (nlmsg_append(msg, &nhdr, sizeof(nhdr), NLMSG_ALIGNTO) < 0)
+ goto errout;
+- }
+- nl_addr_set_prefixlen(nl_ipaddr, prefixlen);
+- res = rtnl_neigh_set_dst(rn, nl_ipaddr);
+- if (res) {
+- wpa_printf(MSG_DEBUG,
+- "nl80211: neigh set destination addr failed");
++
++ if (nla_put(msg, NDA_DST, addrsize, (void *)ipaddr))
+ goto errout;
+- }
+
+- /* set the corresponding lladdr for neigh */
+- nl_lladdr = nl_addr_build(AF_BRIDGE, (u8 *) addr, ETH_ALEN);
+- if (nl_lladdr == NULL) {
+- wpa_printf(MSG_DEBUG, "nl80211: neigh set lladdr failed");
+- res = -ENOMEM;
++ if (nla_put(msg, NDA_LLADDR, ETH_ALEN, (void *)addr))
+ goto errout;
+- }
+- rtnl_neigh_set_lladdr(rn, nl_lladdr);
+
+- rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
+- rtnl_neigh_set_state(rn, NUD_PERMANENT);
++ res = nl_send_auto_complete(drv->rtnl_sk, msg);
++ if (res < 0)
++ goto errout;
+
+- res = rtnl_neigh_add(drv->rtnl_sk, rn, NLM_F_CREATE);
++ res = nl_wait_for_ack(drv->rtnl_sk);
+ if (res) {
+ wpa_printf(MSG_DEBUG,
+ "nl80211: Adding bridge ip neigh failed: %s",
+ nl_geterror(res));
+ }
+ errout:
+- if (nl_lladdr)
+- nl_addr_put(nl_lladdr);
+- if (nl_ipaddr)
+- nl_addr_put(nl_ipaddr);
+- if (rn)
+- rtnl_neigh_put(rn);
++ nlmsg_free(msg);
+ return res;
+-#else /* CONFIG_LIBNL3_ROUTE */
+- return -1;
+-#endif /* CONFIG_LIBNL3_ROUTE */
+ }
+
+
+ static int wpa_driver_br_delete_ip_neigh(void *priv, u8 version,
+ const u8 *ipaddr)
+ {
+-#ifdef CONFIG_LIBNL3_ROUTE
+ struct i802_bss *bss = priv;
+ struct wpa_driver_nl80211_data *drv = bss->drv;
+- struct rtnl_neigh *rn;
+- struct nl_addr *nl_ipaddr;
+- int family, addrsize;
++ struct ndmsg nhdr = {
++ .ndm_state = NUD_PERMANENT,
++ .ndm_ifindex = bss->br_ifindex,
++ };
++ struct nl_msg *msg;
++ int addrsize;
+ int res;
+
+ if (!ipaddr)
+ return -EINVAL;
+
+ if (version == 4) {
+- family = AF_INET;
++ nhdr.ndm_family = AF_INET;
+ addrsize = 4;
+ } else if (version == 6) {
+- family = AF_INET6;
++ nhdr.ndm_family = AF_INET6;
+ addrsize = 16;
+ } else {
+ return -EINVAL;
+@@ -10934,41 +10913,30 @@ static int wpa_driver_br_delete_ip_neigh
+ return -1;
+ }
+
+- rn = rtnl_neigh_alloc();
+- if (rn == NULL)
++ msg = nlmsg_alloc_simple(RTM_DELNEIGH, NLM_F_CREATE);
++ if (!msg)
+ return -ENOMEM;
+
+- /* set the destination ip address for neigh */
+- nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
+- if (nl_ipaddr == NULL) {
+- wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
+- res = -ENOMEM;
++ res = -ENOMEM;
++ if (nlmsg_append(msg, &nhdr, sizeof(nhdr), NLMSG_ALIGNTO) < 0)
+ goto errout;
+- }
+- res = rtnl_neigh_set_dst(rn, nl_ipaddr);
+- if (res) {
+- wpa_printf(MSG_DEBUG,
+- "nl80211: neigh set destination addr failed");
++
++ if (nla_put(msg, NDA_DST, addrsize, (void *)ipaddr))
+ goto errout;
+- }
+
+- rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
++ res = nl_send_auto_complete(drv->rtnl_sk, msg);
++ if (res < 0)
++ goto errout;
+
+- res = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
++ res = nl_wait_for_ack(drv->rtnl_sk);
+ if (res) {
+ wpa_printf(MSG_DEBUG,
+ "nl80211: Deleting bridge ip neigh failed: %s",
+ nl_geterror(res));
+ }
+ errout:
+- if (nl_ipaddr)
+- nl_addr_put(nl_ipaddr);
+- if (rn)
+- rtnl_neigh_put(rn);
++ nlmsg_free(msg);
+ return res;
+-#else /* CONFIG_LIBNL3_ROUTE */
+- return -1;
+-#endif /* CONFIG_LIBNL3_ROUTE */
+ }
+
+
diff --git a/recipes-wifi/hostapd/files/patches-2.11/040-mesh-allow-processing-authentication-frames-in-block.patch b/recipes-wifi/hostapd/files/patches-2.11/040-mesh-allow-processing-authentication-frames-in-block.patch
new file mode 100644
index 0000000..6b34cd4
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/040-mesh-allow-processing-authentication-frames-in-block.patch
@@ -0,0 +1,34 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 18 Feb 2019 12:57:11 +0100
+Subject: [PATCH] mesh: allow processing authentication frames in blocked state
+
+If authentication fails repeatedly e.g. because of a weak signal, the link
+can end up in blocked state. If one of the nodes tries to establish a link
+again before it is unblocked on the other side, it will block the link to
+that other side. The same happens on the other side when it unblocks the
+link. In that scenario, the link never recovers on its own.
+
+To fix this, allow restarting authentication even if the link is in blocked
+state, but don't initiate the attempt until the blocked period is over.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -3781,15 +3781,6 @@ static void handle_auth(struct hostapd_d
+ seq_ctrl);
+ return;
+ }
+-#ifdef CONFIG_MESH
+- if ((hapd->conf->mesh & MESH_ENABLED) &&
+- sta->plink_state == PLINK_BLOCKED) {
+- wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
+- " is blocked - drop Authentication frame",
+- MAC2STR(mgmt->sa));
+- return;
+- }
+-#endif /* CONFIG_MESH */
+ #ifdef CONFIG_PASN
+ if (auth_alg == WLAN_AUTH_PASN &&
+ (sta->flags & WLAN_STA_ASSOC)) {
diff --git a/recipes-wifi/hostapd/files/patches-2.11/050-build_fix.patch b/recipes-wifi/hostapd/files/patches-2.11/050-build_fix.patch
new file mode 100644
index 0000000..c9268f5
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/050-build_fix.patch
@@ -0,0 +1,20 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -324,6 +324,7 @@ ifdef CONFIG_FILS
+ CFLAGS += -DCONFIG_FILS
+ OBJS += ../src/ap/fils_hlp.o
+ NEED_SHA384=y
++NEED_HMAC_SHA384_KDF=y
+ NEED_AES_SIV=y
+ ifdef CONFIG_FILS_SK_PFS
+ CFLAGS += -DCONFIG_FILS_SK_PFS
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -320,6 +320,7 @@ endif
+ ifdef CONFIG_FILS
+ CFLAGS += -DCONFIG_FILS
+ NEED_SHA384=y
++NEED_HMAC_SHA384_KDF=y
+ NEED_AES_SIV=y
+ ifdef CONFIG_FILS_SK_PFS
+ CFLAGS += -DCONFIG_FILS_SK_PFS
diff --git a/recipes-wifi/hostapd/files/patches-2.11/100-daemonize_fix.patch b/recipes-wifi/hostapd/files/patches-2.11/100-daemonize_fix.patch
new file mode 100644
index 0000000..687bd40
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/100-daemonize_fix.patch
@@ -0,0 +1,97 @@
+--- a/src/utils/os_unix.c
++++ b/src/utils/os_unix.c
+@@ -10,6 +10,7 @@
+
+ #include <time.h>
+ #include <sys/wait.h>
++#include <fcntl.h>
+
+ #ifdef ANDROID
+ #include <sys/capability.h>
+@@ -188,59 +189,46 @@ int os_gmtime(os_time_t t, struct os_tm
+ return 0;
+ }
+
+-
+-#ifdef __APPLE__
+-#include <fcntl.h>
+-static int os_daemon(int nochdir, int noclose)
++int os_daemonize(const char *pid_file)
+ {
+- int devnull;
++ int pid = 0, i, devnull;
+
+- if (chdir("/") < 0)
+- return -1;
++#if defined(__uClinux__) || defined(__sun__)
++ return -1;
++#else /* defined(__uClinux__) || defined(__sun__) */
+
+- devnull = open("/dev/null", O_RDWR);
+- if (devnull < 0)
++#ifndef __APPLE__
++ pid = fork();
++ if (pid < 0)
+ return -1;
++#endif
+
+- if (dup2(devnull, STDIN_FILENO) < 0) {
+- close(devnull);
+- return -1;
++ if (pid > 0) {
++ if (pid_file) {
++ FILE *f = fopen(pid_file, "w");
++ if (f) {
++ fprintf(f, "%u\n", pid);
++ fclose(f);
++ }
++ }
++ _exit(0);
+ }
+
+- if (dup2(devnull, STDOUT_FILENO) < 0) {
+- close(devnull);
++ if (setsid() < 0)
+ return -1;
+- }
+
+- if (dup2(devnull, STDERR_FILENO) < 0) {
+- close(devnull);
++ if (chdir("/") < 0)
+ return -1;
+- }
+-
+- return 0;
+-}
+-#else /* __APPLE__ */
+-#define os_daemon daemon
+-#endif /* __APPLE__ */
+
+-
+-int os_daemonize(const char *pid_file)
+-{
+-#if defined(__uClinux__) || defined(__sun__)
+- return -1;
+-#else /* defined(__uClinux__) || defined(__sun__) */
+- if (os_daemon(0, 0)) {
+- perror("daemon");
++ devnull = open("/dev/null", O_RDWR);
++ if (devnull < 0)
+ return -1;
+- }
+
+- if (pid_file) {
+- FILE *f = fopen(pid_file, "w");
+- if (f) {
+- fprintf(f, "%u\n", getpid());
+- fclose(f);
+- }
+- }
++ for (i = 0; i <= STDERR_FILENO; i++)
++ dup2(devnull, i);
++
++ if (devnull > 2)
++ close(devnull);
+
+ return -0;
+ #endif /* defined(__uClinux__) || defined(__sun__) */
diff --git a/recipes-wifi/hostapd/files/patches-2.11/200-multicall.patch b/recipes-wifi/hostapd/files/patches-2.11/200-multicall.patch
new file mode 100644
index 0000000..576c671
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/200-multicall.patch
@@ -0,0 +1,355 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -1,6 +1,7 @@
+ ALL=hostapd hostapd_cli
+ CONFIG_FILE = .config
+
++-include $(if $(MULTICALL), ../wpa_supplicant/.config)
+ include ../src/build.rules
+
+ ifdef LIBS
+@@ -199,7 +200,8 @@ endif
+
+ ifdef CONFIG_NO_VLAN
+ CFLAGS += -DCONFIG_NO_VLAN
+-else
++endif
++ifneq ($(findstring CONFIG_NO_VLAN,$(CFLAGS)), CONFIG_NO_VLAN)
+ OBJS += ../src/ap/vlan_init.o
+ OBJS += ../src/ap/vlan_ifconfig.o
+ OBJS += ../src/ap/vlan.o
+@@ -357,10 +359,14 @@ CFLAGS += -DCONFIG_MBO
+ OBJS += ../src/ap/mbo_ap.o
+ endif
+
++ifndef MULTICALL
++CFLAGS += -DNO_SUPPLICANT
++endif
++
+ include ../src/drivers/drivers.mak
+-OBJS += $(DRV_AP_OBJS)
+-CFLAGS += $(DRV_AP_CFLAGS)
+-LDFLAGS += $(DRV_AP_LDFLAGS)
++OBJS += $(sort $(DRV_AP_OBJS) $(if $(MULTICALL),$(DRV_WPA_OBJS)))
++CFLAGS += $(DRV_AP_CFLAGS) $(if $(MULTICALL),$(DRV_WPA_CFLAGS))
++LDFLAGS += $(DRV_AP_LDFLAGS) $(if $(MULTICALL),$(DRV_WPA_LDFLAGS))
+ LIBS += $(DRV_AP_LIBS)
+
+ ifdef CONFIG_L2_PACKET
+@@ -1291,6 +1297,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
+ _OBJS_VAR := OBJS
+ include ../src/objs.mk
+
++hostapd_multi.a: $(BCHECK) $(OBJS)
++ $(Q)$(CC) -c -o hostapd_multi.o -Dmain=hostapd_main $(CFLAGS) main.c
++ @$(E) " CC " $<
++ @rm -f $@
++ @$(AR) cr $@ hostapd_multi.o $(OBJS)
++
+ hostapd: $(OBJS)
+ $(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
+ @$(E) " LD " $@
+@@ -1365,6 +1377,12 @@ include ../src/objs.mk
+ _OBJS_VAR := SOBJS
+ include ../src/objs.mk
+
++dump_cflags:
++ @printf "%s " "$(CFLAGS)"
++
++dump_ldflags:
++ @printf "%s " "$(LDFLAGS) $(LIBS) $(EXTRALIBS)"
++
+ nt_password_hash: $(NOBJS)
+ $(Q)$(CC) $(LDFLAGS) -o nt_password_hash $(NOBJS) $(LIBS_n)
+ @$(E) " LD " $@
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -10,6 +10,7 @@ ALL += dbus/fi.w1.wpa_supplicant1.servic
+ EXTRA_TARGETS=dynamic_eap_methods
+
+ CONFIG_FILE=.config
++-include $(if $(MULTICALL),../hostapd/.config)
+ include ../src/build.rules
+
+ ifdef CONFIG_BUILD_WPA_CLIENT_SO
+@@ -371,7 +372,9 @@ endif
+ ifdef CONFIG_IBSS_RSN
+ NEED_RSN_AUTHENTICATOR=y
+ CFLAGS += -DCONFIG_IBSS_RSN
++ifndef MULTICALL
+ CFLAGS += -DCONFIG_NO_VLAN
++endif
+ OBJS += ibss_rsn.o
+ endif
+
+@@ -912,6 +915,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
+ CFLAGS += -DCONFIG_DYNAMIC_EAP_METHODS
+ LIBS += -ldl -rdynamic
+ endif
++else
++ ifdef MULTICALL
++ OBJS += ../src/eap_common/eap_common.o
++ endif
+ endif
+
+ ifdef CONFIG_AP
+@@ -919,9 +926,11 @@ NEED_EAP_COMMON=y
+ NEED_RSN_AUTHENTICATOR=y
+ CFLAGS += -DCONFIG_AP
+ OBJS += ap.o
++ifndef MULTICALL
+ CFLAGS += -DCONFIG_NO_RADIUS
+ CFLAGS += -DCONFIG_NO_ACCOUNTING
+ CFLAGS += -DCONFIG_NO_VLAN
++endif
+ OBJS += ../src/ap/hostapd.o
+ OBJS += ../src/ap/wpa_auth_glue.o
+ OBJS += ../src/ap/utils.o
+@@ -1008,6 +1017,12 @@ endif
+ ifdef CONFIG_HS20
+ OBJS += ../src/ap/hs20.o
+ endif
++else
++ ifdef MULTICALL
++ OBJS += ../src/eap_server/eap_server.o
++ OBJS += ../src/eap_server/eap_server_identity.o
++ OBJS += ../src/eap_server/eap_server_methods.o
++ endif
+ endif
+
+ ifdef CONFIG_MBO
+@@ -1016,7 +1031,9 @@ CFLAGS += -DCONFIG_MBO
+ endif
+
+ ifdef NEED_RSN_AUTHENTICATOR
++ifndef MULTICALL
+ CFLAGS += -DCONFIG_NO_RADIUS
++endif
+ NEED_AES_WRAP=y
+ OBJS += ../src/ap/wpa_auth.o
+ OBJS += ../src/ap/wpa_auth_ie.o
+@@ -1920,6 +1937,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
+
+ _OBJS_VAR := OBJS
+ include ../src/objs.mk
++wpa_supplicant_multi.a: .config $(BCHECK) $(OBJS) $(EXTRA_progs)
++ $(Q)$(CC) -c -o wpa_supplicant_multi.o -Dmain=wpa_supplicant_main $(CFLAGS) main.c
++ @$(E) " CC " $<
++ @rm -f $@
++ @$(AR) cr $@ wpa_supplicant_multi.o $(OBJS)
++
+ wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
+ $(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
+ @$(E) " LD " $@
+@@ -2052,6 +2075,12 @@ eap_gpsk.so: $(SRC_EAP_GPSK)
+ $(Q)sed -e 's|\@BINDIR\@|$(BINDIR)|g' $< >$@
+ @$(E) " sed" $<
+
++dump_cflags:
++ @printf "%s " "$(CFLAGS)"
++
++dump_ldflags:
++ @printf "%s " "$(LDFLAGS) $(LIBS) $(EXTRALIBS)"
++
+ wpa_supplicant.exe: wpa_supplicant
+ mv -f $< $@
+ wpa_cli.exe: wpa_cli
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -6171,8 +6171,8 @@ union wpa_event_data {
+ * Driver wrapper code should call this function whenever an event is received
+ * from the driver.
+ */
+-void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
+- union wpa_event_data *data);
++extern void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ /**
+ * wpa_supplicant_event_global - Report a driver event for wpa_supplicant
+@@ -6184,7 +6184,7 @@ void wpa_supplicant_event(void *ctx, enu
+ * Same as wpa_supplicant_event(), but we search for the interface in
+ * wpa_global.
+ */
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++extern void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data);
+
+ /*
+--- a/src/ap/drv_callbacks.c
++++ b/src/ap/drv_callbacks.c
+@@ -1872,8 +1872,8 @@ err:
+ #endif /* CONFIG_OWE */
+
+
+-void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
+- union wpa_event_data *data)
++void hostapd_wpa_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data)
+ {
+ struct hostapd_data *hapd = ctx;
+ #ifndef CONFIG_NO_STDOUT_DEBUG
+@@ -2145,7 +2145,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+
+
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++void hostapd_wpa_event_global(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data)
+ {
+ struct hapd_interfaces *interfaces = ctx;
+--- a/wpa_supplicant/wpa_priv.c
++++ b/wpa_supplicant/wpa_priv.c
+@@ -1038,8 +1038,8 @@ static void wpa_priv_send_ft_response(st
+ }
+
+
+-void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
+- union wpa_event_data *data)
++static void supplicant_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data)
+ {
+ struct wpa_priv_interface *iface = ctx;
+
+@@ -1102,7 +1102,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+
+
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++void supplicant_event_global(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data)
+ {
+ struct wpa_priv_global *global = ctx;
+@@ -1216,6 +1216,8 @@ int main(int argc, char *argv[])
+ if (os_program_init())
+ return -1;
+
++ wpa_supplicant_event = supplicant_event;
++ wpa_supplicant_event_global = supplicant_event_global;
+ wpa_priv_fd_workaround();
+
+ os_memset(&global, 0, sizeof(global));
+--- a/wpa_supplicant/events.c
++++ b/wpa_supplicant/events.c
+@@ -4953,8 +4953,8 @@ static void wpas_event_unprot_beacon(str
+ }
+
+
+-void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
+- union wpa_event_data *data)
++void supplicant_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data)
+ {
+ struct wpa_supplicant *wpa_s = ctx;
+ int resched;
+@@ -5813,7 +5813,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+
+
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++void supplicant_event_global(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data)
+ {
+ struct wpa_supplicant *wpa_s;
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -7087,7 +7087,6 @@ struct wpa_interface * wpa_supplicant_ma
+ return NULL;
+ }
+
+-
+ /**
+ * wpa_supplicant_match_existing - Match existing interfaces
+ * @global: Pointer to global data from wpa_supplicant_init()
+@@ -7122,6 +7121,11 @@ static int wpa_supplicant_match_existing
+
+ #endif /* CONFIG_MATCH_IFACE */
+
++extern void supplicant_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++
++extern void supplicant_event_global(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ /**
+ * wpa_supplicant_add_iface - Add a new network interface
+@@ -7378,6 +7382,8 @@ struct wpa_global * wpa_supplicant_init(
+ #ifndef CONFIG_NO_WPA_MSG
+ wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
+ #endif /* CONFIG_NO_WPA_MSG */
++ wpa_supplicant_event = supplicant_event;
++ wpa_supplicant_event_global = supplicant_event_global;
+
+ if (params->wpa_debug_file_path)
+ wpa_debug_open_file(params->wpa_debug_file_path);
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -591,6 +591,11 @@ fail:
+ return -1;
+ }
+
++void hostapd_wpa_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++
++void hostapd_wpa_event_global(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ #ifdef CONFIG_WPS
+ static int gen_uuid(const char *txt_addr)
+@@ -684,6 +689,8 @@ int main(int argc, char *argv[])
+ return -1;
+ #endif /* CONFIG_DPP */
+
++ wpa_supplicant_event = hostapd_wpa_event;
++ wpa_supplicant_event_global = hostapd_wpa_event_global;
+ for (;;) {
+ c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:q");
+ if (c < 0)
+--- a/src/drivers/drivers.c
++++ b/src/drivers/drivers.c
+@@ -10,6 +10,10 @@
+ #include "utils/common.h"
+ #include "driver.h"
+
++void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ const struct wpa_driver_ops *const wpa_drivers[] =
+ {
+--- a/wpa_supplicant/eapol_test.c
++++ b/wpa_supplicant/eapol_test.c
+@@ -31,7 +31,12 @@
+ #include "ctrl_iface.h"
+ #include "pcsc_funcs.h"
+ #include "wpas_glue.h"
++#include "drivers/driver.h"
+
++void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ const struct wpa_driver_ops *const wpa_drivers[] = { NULL };
+
+@@ -1303,6 +1308,10 @@ static void usage(void)
+ "option several times.\n");
+ }
+
++extern void supplicant_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++extern void supplicant_event_global(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ int main(int argc, char *argv[])
+ {
+@@ -1323,6 +1332,8 @@ int main(int argc, char *argv[])
+ if (os_program_init())
+ return -1;
+
++ wpa_supplicant_event = supplicant_event;
++ wpa_supplicant_event_global = supplicant_event_global;
+ hostapd_logger_register_cb(hostapd_logger_cb);
+
+ os_memset(&eapol_test, 0, sizeof(eapol_test));
diff --git a/recipes-wifi/hostapd/files/patches-2.11/300-noscan.patch b/recipes-wifi/hostapd/files/patches-2.11/300-noscan.patch
new file mode 100644
index 0000000..a0e00c4
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/300-noscan.patch
@@ -0,0 +1,58 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3439,6 +3439,10 @@ static int hostapd_config_fill(struct ho
+ if (bss->ocv && !bss->ieee80211w)
+ bss->ieee80211w = 1;
+ #endif /* CONFIG_OCV */
++ } else if (os_strcmp(buf, "noscan") == 0) {
++ conf->noscan = atoi(pos);
++ } else if (os_strcmp(buf, "ht_coex") == 0) {
++ conf->no_ht_coex = !atoi(pos);
+ } else if (os_strcmp(buf, "ieee80211n") == 0) {
+ conf->ieee80211n = atoi(pos);
+ } else if (os_strcmp(buf, "ht_capab") == 0) {
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1043,6 +1043,8 @@ struct hostapd_config {
+
+ int ht_op_mode_fixed;
+ u16 ht_capab;
++ int noscan;
++ int no_ht_coex;
+ int ieee80211n;
+ int secondary_channel;
+ int no_pri_sec_switch;
+--- a/src/ap/hw_features.c
++++ b/src/ap/hw_features.c
+@@ -517,7 +517,8 @@ static int ieee80211n_check_40mhz(struct
+ int ret;
+
+ /* Check that HT40 is used and PRI / SEC switch is allowed */
+- if (!iface->conf->secondary_channel || iface->conf->no_pri_sec_switch)
++ if (!iface->conf->secondary_channel || iface->conf->no_pri_sec_switch ||
++ iface->conf->noscan)
+ return 0;
+
+ hostapd_set_state(iface, HAPD_IFACE_HT_SCAN);
+--- a/src/ap/ieee802_11_ht.c
++++ b/src/ap/ieee802_11_ht.c
+@@ -230,6 +230,9 @@ void hostapd_2040_coex_action(struct hos
+ return;
+ }
+
++ if (iface->conf->noscan || iface->conf->no_ht_coex)
++ return;
++
+ if (len < IEEE80211_HDRLEN + 2 + sizeof(*bc_ie)) {
+ wpa_printf(MSG_DEBUG,
+ "Ignore too short 20/40 BSS Coexistence Management frame");
+@@ -390,6 +393,9 @@ void ht40_intolerant_add(struct hostapd_
+ if (iface->current_mode->mode != HOSTAPD_MODE_IEEE80211G)
+ return;
+
++ if (iface->conf->noscan || iface->conf->no_ht_coex)
++ return;
++
+ wpa_printf(MSG_INFO, "HT: Forty MHz Intolerant is set by STA " MACSTR
+ " in Association Request", MAC2STR(sta->addr));
+
diff --git a/recipes-wifi/hostapd/files/patches-2.11/301-mesh-noscan.patch b/recipes-wifi/hostapd/files/patches-2.11/301-mesh-noscan.patch
new file mode 100644
index 0000000..9985401
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/301-mesh-noscan.patch
@@ -0,0 +1,71 @@
+--- a/wpa_supplicant/config.c
++++ b/wpa_supplicant/config.c
+@@ -2555,6 +2555,7 @@ static const struct parse_data ssid_fiel
+ #else /* CONFIG_MESH */
+ { INT_RANGE(mode, 0, 4) },
+ #endif /* CONFIG_MESH */
++ { INT_RANGE(noscan, 0, 1) },
+ { INT_RANGE(proactive_key_caching, 0, 1) },
+ { INT_RANGE(disabled, 0, 2) },
+ { STR(id_str) },
+--- a/wpa_supplicant/config_file.c
++++ b/wpa_supplicant/config_file.c
+@@ -766,6 +766,7 @@ static void wpa_config_write_network(FIL
+ #endif /* IEEE8021X_EAPOL */
+ INT(mode);
+ INT(no_auto_peer);
++ INT(noscan);
+ INT(mesh_fwding);
+ INT(frequency);
+ INT(enable_edmg);
+--- a/wpa_supplicant/mesh.c
++++ b/wpa_supplicant/mesh.c
+@@ -506,6 +506,8 @@ static int wpa_supplicant_mesh_init(stru
+ frequency);
+ goto out_free;
+ }
++ if (ssid->noscan)
++ conf->noscan = 1;
+
+ if (ssid->mesh_basic_rates == NULL) {
+ /*
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -2463,7 +2463,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ int ieee80211_mode = wpas_mode_to_ieee80211_mode(ssid->mode);
+ enum hostapd_hw_mode hw_mode;
+ struct hostapd_hw_modes *mode = NULL;
+- int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
++ int ht40plus[] = { 1, 2, 3, 4, 5, 6, 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
+ 184, 192 };
+ int bw80[] = { 5180, 5260, 5500, 5580, 5660, 5745, 5955,
+ 6035, 6115, 6195, 6275, 6355, 6435, 6515,
+@@ -2471,7 +2471,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ int bw160[] = { 5955, 6115, 6275, 6435, 6595, 6755, 6915 };
+ struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
+ u8 channel;
+- int i, chan_idx, ht40 = -1, res, obss_scan = 1;
++ int i, chan_idx, ht40 = -1, res, obss_scan = !(ssid->noscan);
+ unsigned int j, k;
+ struct hostapd_freq_params vht_freq;
+ int chwidth, seg0, seg1;
+@@ -2562,7 +2562,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ #endif /* CONFIG_HE_OVERRIDES */
+
+ /* Setup higher BW only for 5 GHz */
+- if (mode->mode != HOSTAPD_MODE_IEEE80211A)
++ if (mode->mode != HOSTAPD_MODE_IEEE80211A && !(ssid->noscan))
+ return;
+
+ for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
+--- a/wpa_supplicant/config_ssid.h
++++ b/wpa_supplicant/config_ssid.h
+@@ -981,6 +981,8 @@ struct wpa_ssid {
+ */
+ int no_auto_peer;
+
++ int noscan;
++
+ /**
+ * mesh_rssi_threshold - Set mesh parameter mesh_rssi_threshold (dBm)
+ *
diff --git a/recipes-wifi/hostapd/files/patches-2.11/310-rescan_immediately.patch b/recipes-wifi/hostapd/files/patches-2.11/310-rescan_immediately.patch
new file mode 100644
index 0000000..2c25419
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/310-rescan_immediately.patch
@@ -0,0 +1,11 @@
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -5419,7 +5419,7 @@ wpa_supplicant_alloc(struct wpa_supplica
+ if (wpa_s == NULL)
+ return NULL;
+ wpa_s->scan_req = INITIAL_SCAN_REQ;
+- wpa_s->scan_interval = 5;
++ wpa_s->scan_interval = 1;
+ wpa_s->new_connection = 1;
+ wpa_s->parent = parent ? parent : wpa_s;
+ wpa_s->p2pdev = wpa_s->parent;
diff --git a/recipes-wifi/hostapd/files/patches-2.11/320-optional_rfkill.patch b/recipes-wifi/hostapd/files/patches-2.11/320-optional_rfkill.patch
new file mode 100644
index 0000000..0153779
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/320-optional_rfkill.patch
@@ -0,0 +1,61 @@
+--- a/src/drivers/drivers.mak
++++ b/src/drivers/drivers.mak
+@@ -54,7 +54,6 @@ NEED_SME=y
+ NEED_AP_MLME=y
+ NEED_NETLINK=y
+ NEED_LINUX_IOCTL=y
+-NEED_RFKILL=y
+ NEED_RADIOTAP=y
+ NEED_LIBNL=y
+ endif
+@@ -111,7 +110,6 @@ DRV_WPA_CFLAGS += -DCONFIG_DRIVER_WEXT
+ CONFIG_WIRELESS_EXTENSION=y
+ NEED_NETLINK=y
+ NEED_LINUX_IOCTL=y
+-NEED_RFKILL=y
+ endif
+
+ ifdef CONFIG_DRIVER_NDIS
+@@ -137,7 +135,6 @@ endif
+ ifdef CONFIG_WIRELESS_EXTENSION
+ DRV_WPA_CFLAGS += -DCONFIG_WIRELESS_EXTENSION
+ DRV_WPA_OBJS += ../src/drivers/driver_wext.o
+-NEED_RFKILL=y
+ endif
+
+ ifdef NEED_NETLINK
+@@ -146,6 +143,7 @@ endif
+
+ ifdef NEED_RFKILL
+ DRV_OBJS += ../src/drivers/rfkill.o
++DRV_WPA_CFLAGS += -DCONFIG_RFKILL
+ endif
+
+ ifdef NEED_RADIOTAP
+--- a/src/drivers/rfkill.h
++++ b/src/drivers/rfkill.h
+@@ -18,8 +18,24 @@ struct rfkill_config {
+ void (*unblocked_cb)(void *ctx);
+ };
+
++#ifdef CONFIG_RFKILL
+ struct rfkill_data * rfkill_init(struct rfkill_config *cfg);
+ void rfkill_deinit(struct rfkill_data *rfkill);
+ int rfkill_is_blocked(struct rfkill_data *rfkill);
++#else
++static inline struct rfkill_data * rfkill_init(struct rfkill_config *cfg)
++{
++ return (void *) 1;
++}
++
++static inline void rfkill_deinit(struct rfkill_data *rfkill)
++{
++}
++
++static inline int rfkill_is_blocked(struct rfkill_data *rfkill)
++{
++ return 0;
++}
++#endif
+
+ #endif /* RFKILL_H */
diff --git a/recipes-wifi/hostapd/files/patches-2.11/330-nl80211_fix_set_freq.patch b/recipes-wifi/hostapd/files/patches-2.11/330-nl80211_fix_set_freq.patch
new file mode 100644
index 0000000..8218a43
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/330-nl80211_fix_set_freq.patch
@@ -0,0 +1,11 @@
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -5022,7 +5022,7 @@ static int nl80211_set_channel(struct i8
+ freq->he_enabled, freq->eht_enabled, freq->bandwidth,
+ freq->center_freq1, freq->center_freq2);
+
+- msg = nl80211_drv_msg(drv, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
++ msg = nl80211_bss_msg(bss, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
+ NL80211_CMD_SET_WIPHY);
+ if (!msg || nl80211_put_freq_params(msg, freq) < 0) {
+ nlmsg_free(msg);
diff --git a/recipes-wifi/hostapd/files/patches-2.11/340-reload_freq_change.patch b/recipes-wifi/hostapd/files/patches-2.11/340-reload_freq_change.patch
new file mode 100644
index 0000000..b591074
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/340-reload_freq_change.patch
@@ -0,0 +1,76 @@
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -119,6 +119,29 @@ static void hostapd_reload_bss(struct ho
+ #endif /* CONFIG_NO_RADIUS */
+
+ ssid = &hapd->conf->ssid;
++
++ hostapd_set_freq(hapd, hapd->iconf->hw_mode, hapd->iface->freq,
++ hapd->iconf->channel,
++ hapd->iconf->enable_edmg,
++ hapd->iconf->edmg_channel,
++ hapd->iconf->ieee80211n,
++ hapd->iconf->ieee80211ac,
++ hapd->iconf->ieee80211ax,
++ hapd->iconf->ieee80211be,
++ hapd->iconf->secondary_channel,
++ hostapd_get_oper_chwidth(hapd->iconf),
++ hostapd_get_oper_centr_freq_seg0_idx(hapd->iconf),
++ hostapd_get_oper_centr_freq_seg1_idx(hapd->iconf));
++
++ if (hapd->iface->current_mode) {
++ if (hostapd_prepare_rates(hapd->iface, hapd->iface->current_mode)) {
++ wpa_printf(MSG_ERROR, "Failed to prepare rates table.");
++ hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
++ HOSTAPD_LEVEL_WARNING,
++ "Failed to prepare rates table.");
++ }
++ }
++
+ if (!ssid->wpa_psk_set && ssid->wpa_psk && !ssid->wpa_psk->next &&
+ ssid->wpa_passphrase_set && ssid->wpa_passphrase) {
+ /*
+@@ -220,6 +243,7 @@ int hostapd_reload_config(struct hostapd
+ struct hostapd_data *hapd = iface->bss[0];
+ struct hostapd_config *newconf, *oldconf;
+ size_t j;
++ int i;
+
+ if (iface->config_fname == NULL) {
+ /* Only in-memory config in use - assume it has been updated */
+@@ -270,24 +294,20 @@ int hostapd_reload_config(struct hostapd
+ }
+ iface->conf = newconf;
+
++ for (i = 0; i < iface->num_hw_features; i++) {
++ struct hostapd_hw_modes *mode = &iface->hw_features[i];
++ if (mode->mode == iface->conf->hw_mode) {
++ iface->current_mode = mode;
++ break;
++ }
++ }
++
++ if (iface->conf->channel)
++ iface->freq = hostapd_hw_get_freq(hapd, iface->conf->channel);
++
+ for (j = 0; j < iface->num_bss; j++) {
+ hapd = iface->bss[j];
+ hapd->iconf = newconf;
+- hapd->iconf->channel = oldconf->channel;
+- hapd->iconf->acs = oldconf->acs;
+- hapd->iconf->secondary_channel = oldconf->secondary_channel;
+- hapd->iconf->ieee80211n = oldconf->ieee80211n;
+- hapd->iconf->ieee80211ac = oldconf->ieee80211ac;
+- hapd->iconf->ht_capab = oldconf->ht_capab;
+- hapd->iconf->vht_capab = oldconf->vht_capab;
+- hostapd_set_oper_chwidth(hapd->iconf,
+- hostapd_get_oper_chwidth(oldconf));
+- hostapd_set_oper_centr_freq_seg0_idx(
+- hapd->iconf,
+- hostapd_get_oper_centr_freq_seg0_idx(oldconf));
+- hostapd_set_oper_centr_freq_seg1_idx(
+- hapd->iconf,
+- hostapd_get_oper_centr_freq_seg1_idx(oldconf));
+ hapd->conf = newconf->bss[j];
+ hostapd_reload_bss(hapd);
+ }
diff --git a/recipes-wifi/hostapd/files/patches-2.11/341-mesh-ctrl-iface-channel-switch.patch b/recipes-wifi/hostapd/files/patches-2.11/341-mesh-ctrl-iface-channel-switch.patch
new file mode 100644
index 0000000..29a3799
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/341-mesh-ctrl-iface-channel-switch.patch
@@ -0,0 +1,39 @@
+--- a/wpa_supplicant/ap.c
++++ b/wpa_supplicant/ap.c
+@@ -1803,15 +1803,35 @@ int ap_switch_channel(struct wpa_supplic
+
+
+ #ifdef CONFIG_CTRL_IFACE
++
++static int __ap_ctrl_iface_chanswitch(struct hostapd_iface *iface,
++ struct csa_settings *settings)
++{
++#ifdef NEED_AP_MLME
++ if (!iface || !iface->bss[0])
++ return 0;
++
++ return hostapd_switch_channel(iface->bss[0], settings);
++#else
++ return -1;
++#endif
++}
++
++
+ int ap_ctrl_iface_chanswitch(struct wpa_supplicant *wpa_s, const char *pos)
+ {
+ struct csa_settings settings;
+ int ret = hostapd_parse_csa_settings(pos, &settings);
+
++ if (!(wpa_s->ap_iface && wpa_s->ap_iface->bss[0]) &&
++ !(wpa_s->ifmsh && wpa_s->ifmsh->bss[0]))
++ return -1;
++
++ ret = __ap_ctrl_iface_chanswitch(wpa_s->ap_iface, &settings);
+ if (ret)
+ return ret;
+
+- return ap_switch_channel(wpa_s, &settings);
++ return __ap_ctrl_iface_chanswitch(wpa_s->ifmsh, &settings);
+ }
+ #endif /* CONFIG_CTRL_IFACE */
+
diff --git a/recipes-wifi/hostapd/files/patches-2.11/350-nl80211_del_beacon_bss.patch b/recipes-wifi/hostapd/files/patches-2.11/350-nl80211_del_beacon_bss.patch
new file mode 100644
index 0000000..85298df
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/350-nl80211_del_beacon_bss.patch
@@ -0,0 +1,34 @@
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -2938,11 +2938,11 @@ static int wpa_driver_nl80211_del_beacon
+ struct wpa_driver_nl80211_data *drv = bss->drv;
+
+ wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
+- drv->ifindex);
++ bss->ifindex);
+ bss->beacon_set = 0;
+ bss->freq = 0;
+ nl80211_put_wiphy_data_ap(bss);
+- msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
++ msg = nl80211_bss_msg(drv, 0, NL80211_CMD_DEL_BEACON);
+ return send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
+ }
+
+@@ -5661,7 +5661,7 @@ static void nl80211_teardown_ap(struct i
+ nl80211_mgmt_unsubscribe(bss, "AP teardown");
+
+ nl80211_put_wiphy_data_ap(bss);
+- bss->beacon_set = 0;
++ wpa_driver_nl80211_del_beacon(bss);
+ }
+
+
+@@ -8120,8 +8120,6 @@ static int wpa_driver_nl80211_if_remove(
+ } else {
+ wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
+ nl80211_teardown_ap(bss);
+- if (!bss->added_if && !drv->first_bss->next)
+- wpa_driver_nl80211_del_beacon(bss);
+ nl80211_destroy_bss(bss);
+ if (!bss->added_if)
+ i802_set_iface_flags(bss, 0);
diff --git a/recipes-wifi/hostapd/files/patches-2.11/360-ctrl_iface_reload.patch b/recipes-wifi/hostapd/files/patches-2.11/360-ctrl_iface_reload.patch
new file mode 100644
index 0000000..7699541
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/360-ctrl_iface_reload.patch
@@ -0,0 +1,106 @@
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -67,6 +67,7 @@
+ #include "fst/fst_ctrl_iface.h"
+ #include "config_file.h"
+ #include "ctrl_iface.h"
++#include "config_file.h"
+
+
+ #define HOSTAPD_CLI_DUP_VALUE_MAX_LEN 256
+@@ -82,6 +83,7 @@ static void hostapd_ctrl_iface_send(stru
+ enum wpa_msg_type type,
+ const char *buf, size_t len);
+
++static char *reload_opts = NULL;
+
+ static int hostapd_ctrl_iface_attach(struct hostapd_data *hapd,
+ struct sockaddr_storage *from,
+@@ -133,6 +135,61 @@ static int hostapd_ctrl_iface_new_sta(st
+ return 0;
+ }
+
++static char *get_option(char *opt, char *str)
++{
++ int len = strlen(str);
++
++ if (!strncmp(opt, str, len))
++ return opt + len;
++ else
++ return NULL;
++}
++
++static struct hostapd_config *hostapd_ctrl_iface_config_read(const char *fname)
++{
++ struct hostapd_config *conf;
++ char *opt, *val;
++
++ conf = hostapd_config_read(fname);
++ if (!conf)
++ return NULL;
++
++ for (opt = strtok(reload_opts, " ");
++ opt;
++ opt = strtok(NULL, " ")) {
++
++ if ((val = get_option(opt, "channel=")))
++ conf->channel = atoi(val);
++ else if ((val = get_option(opt, "ht_capab=")))
++ conf->ht_capab = atoi(val);
++ else if ((val = get_option(opt, "ht_capab_mask=")))
++ conf->ht_capab &= atoi(val);
++ else if ((val = get_option(opt, "sec_chan=")))
++ conf->secondary_channel = atoi(val);
++ else if ((val = get_option(opt, "hw_mode=")))
++ conf->hw_mode = atoi(val);
++ else if ((val = get_option(opt, "ieee80211n=")))
++ conf->ieee80211n = atoi(val);
++ else
++ break;
++ }
++
++ return conf;
++}
++
++static int hostapd_ctrl_iface_update(struct hostapd_data *hapd, char *txt)
++{
++ struct hostapd_config * (*config_read_cb)(const char *config_fname);
++ struct hostapd_iface *iface = hapd->iface;
++
++ config_read_cb = iface->interfaces->config_read_cb;
++ iface->interfaces->config_read_cb = hostapd_ctrl_iface_config_read;
++ reload_opts = txt;
++
++ hostapd_reload_config(iface);
++
++ iface->interfaces->config_read_cb = config_read_cb;
++}
+
+ #ifdef NEED_AP_MLME
+ static int hostapd_ctrl_iface_sa_query(struct hostapd_data *hapd,
+@@ -3449,6 +3506,8 @@ static int hostapd_ctrl_iface_receive_pr
+ } else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
+ reply_len = hostapd_ctrl_iface_vendor(hapd, buf + 7, reply,
+ reply_size);
++ } else if (os_strncmp(buf, "UPDATE ", 7) == 0) {
++ hostapd_ctrl_iface_update(hapd, buf + 7);
+ } else if (os_strcmp(buf, "ERP_FLUSH") == 0) {
+ ieee802_1x_erp_flush(hapd);
+ #ifdef RADIUS_SERVER
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -945,7 +945,13 @@ int hostapd_parse_csa_settings(const cha
+
+ int hostapd_ctrl_iface_stop_ap(struct hostapd_data *hapd)
+ {
+- return hostapd_drv_stop_ap(hapd);
++ struct hostapd_iface *iface = hapd->iface;
++ int i;
++
++ for (i = 0; i < iface->num_bss; i++)
++ hostapd_drv_stop_ap(iface->bss[i]);
++
++ return 0;
+ }
+
+
diff --git a/recipes-wifi/hostapd/files/patches-2.11/370-ap_sta_support.patch b/recipes-wifi/hostapd/files/patches-2.11/370-ap_sta_support.patch
new file mode 100644
index 0000000..6faaffc
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/370-ap_sta_support.patch
@@ -0,0 +1,393 @@
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -115,6 +115,8 @@ OBJS_c += ../src/utils/common.o
+ OBJS_c += ../src/common/cli.o
+ OBJS += wmm_ac.o
+
++OBJS += ../src/common/wpa_ctrl.o
++
+ ifndef CONFIG_OS
+ ifdef CONFIG_NATIVE_WINDOWS
+ CONFIG_OS=win32
+--- a/wpa_supplicant/bss.c
++++ b/wpa_supplicant/bss.c
+@@ -11,6 +11,7 @@
+ #include "utils/common.h"
+ #include "utils/eloop.h"
+ #include "common/ieee802_11_defs.h"
++#include "common/ieee802_11_common.h"
+ #include "drivers/driver.h"
+ #include "eap_peer/eap.h"
+ #include "wpa_supplicant_i.h"
+@@ -282,6 +283,10 @@ void calculate_update_time(const struct
+ static void wpa_bss_copy_res(struct wpa_bss *dst, struct wpa_scan_res *src,
+ struct os_reltime *fetch_time)
+ {
++ struct ieee80211_ht_capabilities *capab;
++ struct ieee80211_ht_operation *oper;
++ struct ieee802_11_elems elems;
++
+ dst->flags = src->flags;
+ os_memcpy(dst->bssid, src->bssid, ETH_ALEN);
+ dst->freq = src->freq;
+@@ -295,6 +300,15 @@ static void wpa_bss_copy_res(struct wpa_
+ dst->est_throughput = src->est_throughput;
+ dst->snr = src->snr;
+
++ memset(&elems, 0, sizeof(elems));
++ ieee802_11_parse_elems((u8 *) (src + 1), src->ie_len, &elems, 0);
++ capab = (struct ieee80211_ht_capabilities *) elems.ht_capabilities;
++ oper = (struct ieee80211_ht_operation *) elems.ht_operation;
++ if (capab)
++ dst->ht_capab = le_to_host16(capab->ht_capabilities_info);
++ if (oper)
++ dst->ht_param = oper->ht_param;
++
+ calculate_update_time(fetch_time, src->age, &dst->last_update);
+ }
+
+--- a/wpa_supplicant/bss.h
++++ b/wpa_supplicant/bss.h
+@@ -94,6 +94,10 @@ struct wpa_bss {
+ u8 ssid[SSID_MAX_LEN];
+ /** Length of SSID */
+ size_t ssid_len;
++ /** HT capabilities */
++ u16 ht_capab;
++ /* Five octets of HT Operation Information */
++ u8 ht_param;
+ /** Frequency of the channel in MHz (e.g., 2412 = channel 1) */
+ int freq;
+ /** Beacon interval in TUs (host byte order) */
+--- a/wpa_supplicant/main.c
++++ b/wpa_supplicant/main.c
+@@ -35,7 +35,7 @@ static void usage(void)
+ "vW] [-P<pid file>] "
+ "[-g<global ctrl>] \\\n"
+ " [-G<group>] \\\n"
+- " -i<ifname> -c<config file> [-C<ctrl>] [-D<driver>] "
++ " -i<ifname> -c<config file> [-C<ctrl>] [-D<driver>] [-H<hostapd path>] "
+ "[-p<driver_param>] \\\n"
+ " [-b<br_ifname>] [-e<entropy file>]"
+ #ifdef CONFIG_DEBUG_FILE
+@@ -75,6 +75,7 @@ static void usage(void)
+ " -g = global ctrl_interface\n"
+ " -G = global ctrl_interface group\n"
+ " -h = show this help text\n"
++ " -H = connect to a hostapd instance to manage state changes\n"
+ " -i = interface name\n"
+ " -I = additional configuration file\n"
+ " -K = include keys (passwords, etc.) in debug output\n"
+@@ -202,7 +203,7 @@ int main(int argc, char *argv[])
+
+ for (;;) {
+ c = getopt(argc, argv,
+- "b:Bc:C:D:de:f:g:G:hi:I:KLMm:No:O:p:P:qsTtuvW");
++ "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuvW");
+ if (c < 0)
+ break;
+ switch (c) {
+@@ -249,6 +250,9 @@ int main(int argc, char *argv[])
+ usage();
+ exitcode = 0;
+ goto out;
++ case 'H':
++ iface->hostapd_ctrl = optarg;
++ break;
+ case 'i':
+ iface->ifname = optarg;
+ break;
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -131,6 +131,54 @@ static void wpas_update_fils_connect_par
+ static void wpas_update_owe_connect_params(struct wpa_supplicant *wpa_s);
+ #endif /* CONFIG_OWE */
+
++static int hostapd_stop(struct wpa_supplicant *wpa_s)
++{
++ const char *cmd = "STOP_AP";
++ char buf[256];
++ size_t len = sizeof(buf);
++
++ if (wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL) < 0) {
++ wpa_printf(MSG_ERROR, "\nFailed to stop hostapd AP interfaces\n");
++ return -1;
++ }
++ return 0;
++}
++
++static int hostapd_reload(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
++{
++ char *cmd = NULL;
++ char buf[256];
++ size_t len = sizeof(buf);
++ enum hostapd_hw_mode hw_mode;
++ u8 channel;
++ int sec_chan = 0;
++ int ret;
++
++ if (!bss)
++ return -1;
++
++ if (bss->ht_param & HT_INFO_HT_PARAM_STA_CHNL_WIDTH) {
++ int sec = bss->ht_param & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
++ if (sec == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
++ sec_chan = 1;
++ else if (sec == HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
++ sec_chan = -1;
++ }
++
++ hw_mode = ieee80211_freq_to_chan(bss->freq, &channel);
++ if (asprintf(&cmd, "UPDATE channel=%d sec_chan=%d hw_mode=%d",
++ channel, sec_chan, hw_mode) < 0)
++ return -1;
++
++ ret = wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL);
++ free(cmd);
++
++ if (ret < 0) {
++ wpa_printf(MSG_ERROR, "\nFailed to reload hostapd AP interfaces\n");
++ return -1;
++ }
++ return 0;
++}
+
+ #ifdef CONFIG_WEP
+ /* Configure default/group WEP keys for static WEP */
+@@ -1016,6 +1064,8 @@ void wpa_supplicant_set_state(struct wpa
+
+ sme_sched_obss_scan(wpa_s, 1);
+
++ if (wpa_s->hostapd)
++ hostapd_reload(wpa_s, wpa_s->current_bss);
+ #if defined(CONFIG_FILS) && defined(IEEE8021X_EAPOL)
+ if (!fils_hlp_sent && ssid && ssid->eap.erp)
+ update_fils_connect_params = true;
+@@ -1026,6 +1076,8 @@ void wpa_supplicant_set_state(struct wpa
+ #endif /* CONFIG_OWE */
+ } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
+ state == WPA_ASSOCIATED) {
++ if (wpa_s->hostapd)
++ hostapd_stop(wpa_s);
+ wpa_s->new_connection = 1;
+ wpa_drv_set_operstate(wpa_s, 0);
+ #ifndef IEEE8021X_EAPOL
+@@ -2335,6 +2387,8 @@ void wpa_supplicant_associate(struct wpa
+ return;
+ }
+ wpa_s->current_bss = bss;
++ if (wpa_s->hostapd)
++ hostapd_reload(wpa_s, wpa_s->current_bss);
+ #else /* CONFIG_MESH */
+ wpa_msg(wpa_s, MSG_ERROR,
+ "mesh mode support not included in the build");
+@@ -6693,6 +6747,16 @@ static int wpa_supplicant_init_iface(str
+ sizeof(wpa_s->bridge_ifname));
+ }
+
++ if (iface->hostapd_ctrl) {
++ wpa_s->hostapd = wpa_ctrl_open(iface->hostapd_ctrl);
++ if (!wpa_s->hostapd) {
++ wpa_printf(MSG_ERROR, "\nFailed to connect to hostapd\n");
++ return -1;
++ }
++ if (hostapd_stop(wpa_s) < 0)
++ return -1;
++ }
++
+ /* RSNA Supplicant Key Management - INITIALIZE */
+ eapol_sm_notify_portEnabled(wpa_s->eapol, false);
+ eapol_sm_notify_portValid(wpa_s->eapol, false);
+@@ -7031,6 +7095,11 @@ static void wpa_supplicant_deinit_iface(
+ if (terminate)
+ wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
+
++ if (wpa_s->hostapd) {
++ wpa_ctrl_close(wpa_s->hostapd);
++ wpa_s->hostapd = NULL;
++ }
++
+ wpa_supplicant_ctrl_iface_deinit(wpa_s, wpa_s->ctrl_iface);
+ wpa_s->ctrl_iface = NULL;
+
+--- a/wpa_supplicant/wpa_supplicant_i.h
++++ b/wpa_supplicant/wpa_supplicant_i.h
+@@ -105,6 +105,11 @@ struct wpa_interface {
+ const char *ifname;
+
+ /**
++ * hostapd_ctrl - path to hostapd control socket for notification
++ */
++ const char *hostapd_ctrl;
++
++ /**
+ * bridge_ifname - Optional bridge interface name
+ *
+ * If the driver interface (ifname) is included in a Linux bridge
+@@ -717,6 +722,8 @@ struct wpa_supplicant {
+ #endif /* CONFIG_CTRL_IFACE_BINDER */
+ char bridge_ifname[16];
+
++ struct wpa_ctrl *hostapd;
++
+ char *confname;
+ char *confanother;
+
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -2641,6 +2641,12 @@ static int hostapd_ctrl_iface_chan_switc
+ return 0;
+ }
+
++ if (os_strstr(pos, " auto-ht")) {
++ settings.freq_params.ht_enabled = iface->conf->ieee80211n;
++ settings.freq_params.vht_enabled = iface->conf->ieee80211ac;
++ settings.freq_params.he_enabled = iface->conf->ieee80211ax;
++ }
++
+ for (i = 0; i < iface->num_bss; i++) {
+
+ /* Save CHAN_SWITCH VHT, HE, and EHT config */
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1903,11 +1903,6 @@ static int __ieee802_11_set_beacon(struc
+ return -1;
+ }
+
+- if (hapd->csa_in_progress) {
+- wpa_printf(MSG_ERROR, "Cannot set beacons during CSA period");
+- return -1;
+- }
+-
+ hapd->beacon_set_done = 1;
+
+ if (ieee802_11_build_ap_params(hapd, ¶ms) < 0)
+--- a/wpa_supplicant/events.c
++++ b/wpa_supplicant/events.c
+@@ -4953,6 +4953,60 @@ static void wpas_event_unprot_beacon(str
+ }
+
+
++static void
++supplicant_ch_switch_started(struct wpa_supplicant *wpa_s,
++ union wpa_event_data *data)
++{
++ char buf[256];
++ size_t len = sizeof(buf);
++ char *cmd = NULL;
++ int width = 20;
++ int ret;
++
++ if (!wpa_s->hostapd)
++ return;
++
++ wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CHANNEL_SWITCH
++ "count=%d freq=%d ht_enabled=%d ch_offset=%d ch_width=%s cf1=%d cf2=%d",
++ data->ch_switch.count,
++ data->ch_switch.freq,
++ data->ch_switch.ht_enabled,
++ data->ch_switch.ch_offset,
++ channel_width_to_string(data->ch_switch.ch_width),
++ data->ch_switch.cf1,
++ data->ch_switch.cf2);
++
++ switch (data->ch_switch.ch_width) {
++ case CHAN_WIDTH_20_NOHT:
++ case CHAN_WIDTH_20:
++ width = 20;
++ break;
++ case CHAN_WIDTH_40:
++ width = 40;
++ break;
++ case CHAN_WIDTH_80:
++ width = 80;
++ break;
++ case CHAN_WIDTH_160:
++ case CHAN_WIDTH_80P80:
++ width = 160;
++ break;
++ }
++
++ asprintf(&cmd, "CHAN_SWITCH %d %d sec_channel_offset=%d center_freq1=%d center_freq2=%d, bandwidth=%d auto-ht\n",
++ data->ch_switch.count - 1,
++ data->ch_switch.freq,
++ data->ch_switch.ch_offset,
++ data->ch_switch.cf1,
++ data->ch_switch.cf2,
++ width);
++ ret = wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL);
++ free(cmd);
++
++ if (ret < 0)
++ wpa_printf(MSG_ERROR, "\nFailed to reload hostapd AP interfaces\n");
++}
++
+ void supplicant_event(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data)
+ {
+@@ -5268,8 +5322,10 @@ void supplicant_event(void *ctx, enum wp
+ channel_width_to_string(data->ch_switch.ch_width),
+ data->ch_switch.cf1,
+ data->ch_switch.cf2);
+- if (event == EVENT_CH_SWITCH_STARTED)
++ if (event == EVENT_CH_SWITCH_STARTED) {
++ supplicant_ch_switch_started(wpa_s, data);
+ break;
++ }
+
+ wpa_s->assoc_freq = data->ch_switch.freq;
+ wpa_s->current_ssid->frequency = data->ch_switch.freq;
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -5968,6 +5968,7 @@ union wpa_event_data {
+
+ /**
+ * struct ch_switch
++ * @count: Count until channel switch activates
+ * @freq: Frequency of new channel in MHz
+ * @ht_enabled: Whether this is an HT channel
+ * @ch_offset: Secondary channel offset
+@@ -5976,6 +5977,7 @@ union wpa_event_data {
+ * @cf2: Center frequency 2
+ */
+ struct ch_switch {
++ int count;
+ int freq;
+ int ht_enabled;
+ int ch_offset;
+--- a/src/drivers/driver_nl80211_event.c
++++ b/src/drivers/driver_nl80211_event.c
+@@ -694,7 +694,7 @@ static void mlme_event_ch_switch(struct
+ struct nlattr *ifindex, struct nlattr *freq,
+ struct nlattr *type, struct nlattr *bw,
+ struct nlattr *cf1, struct nlattr *cf2,
+- int finished)
++ struct nlattr *count, int finished)
+ {
+ struct i802_bss *bss;
+ union wpa_event_data data;
+@@ -755,6 +755,8 @@ static void mlme_event_ch_switch(struct
+ data.ch_switch.cf1 = nla_get_u32(cf1);
+ if (cf2)
+ data.ch_switch.cf2 = nla_get_u32(cf2);
++ if (count)
++ data.ch_switch.count = nla_get_u32(count);
+
+ if (finished)
+ bss->freq = data.ch_switch.freq;
+@@ -3113,6 +3115,7 @@ static void do_process_drv_event(struct
+ tb[NL80211_ATTR_CHANNEL_WIDTH],
+ tb[NL80211_ATTR_CENTER_FREQ1],
+ tb[NL80211_ATTR_CENTER_FREQ2],
++ tb[NL80211_ATTR_CH_SWITCH_COUNT],
+ 0);
+ break;
+ case NL80211_CMD_CH_SWITCH_NOTIFY:
+@@ -3123,6 +3126,7 @@ static void do_process_drv_event(struct
+ tb[NL80211_ATTR_CHANNEL_WIDTH],
+ tb[NL80211_ATTR_CENTER_FREQ1],
+ tb[NL80211_ATTR_CENTER_FREQ2],
++ NULL,
+ 1);
+ break;
+ case NL80211_CMD_DISCONNECT:
diff --git a/recipes-wifi/hostapd/files/patches-2.11/380-disable_ctrl_iface_mib.patch b/recipes-wifi/hostapd/files/patches-2.11/380-disable_ctrl_iface_mib.patch
new file mode 100644
index 0000000..1f78c42
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/380-disable_ctrl_iface_mib.patch
@@ -0,0 +1,193 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -221,6 +221,9 @@ endif
+ ifdef CONFIG_NO_CTRL_IFACE
+ CFLAGS += -DCONFIG_NO_CTRL_IFACE
+ else
++ifdef CONFIG_CTRL_IFACE_MIB
++CFLAGS += -DCONFIG_CTRL_IFACE_MIB
++endif
+ ifeq ($(CONFIG_CTRL_IFACE), udp)
+ CFLAGS += -DCONFIG_CTRL_IFACE_UDP
+ else
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3265,6 +3265,7 @@ static int hostapd_ctrl_iface_receive_pr
+ reply_size);
+ } else if (os_strcmp(buf, "STATUS-DRIVER") == 0) {
+ reply_len = hostapd_drv_status(hapd, reply, reply_size);
++#ifdef CONFIG_CTRL_IFACE_MIB
+ } else if (os_strcmp(buf, "MIB") == 0) {
+ reply_len = ieee802_11_get_mib(hapd, reply, reply_size);
+ if (reply_len >= 0) {
+@@ -3306,6 +3307,7 @@ static int hostapd_ctrl_iface_receive_pr
+ } else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
+ reply_len = hostapd_ctrl_iface_sta_next(hapd, buf + 9, reply,
+ reply_size);
++#endif
+ } else if (os_strcmp(buf, "ATTACH") == 0) {
+ if (hostapd_ctrl_iface_attach(hapd, from, fromlen, NULL))
+ reply_len = -1;
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -973,6 +973,9 @@ ifdef CONFIG_FILS
+ OBJS += ../src/ap/fils_hlp.o
+ endif
+ ifdef CONFIG_CTRL_IFACE
++ifdef CONFIG_CTRL_IFACE_MIB
++CFLAGS += -DCONFIG_CTRL_IFACE_MIB
++endif
+ OBJS += ../src/ap/ctrl_iface_ap.o
+ endif
+
+--- a/wpa_supplicant/ctrl_iface.c
++++ b/wpa_supplicant/ctrl_iface.c
+@@ -2325,7 +2325,7 @@ static int wpa_supplicant_ctrl_iface_sta
+ pos += ret;
+ }
+
+-#ifdef CONFIG_AP
++#if defined(CONFIG_AP) && defined(CONFIG_CTRL_IFACE_MIB)
+ if (wpa_s->ap_iface) {
+ pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
+ end - pos,
+@@ -11565,6 +11565,7 @@ char * wpa_supplicant_ctrl_iface_process
+ reply_len = -1;
+ } else if (os_strncmp(buf, "NOTE ", 5) == 0) {
+ wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
++#ifdef CONFIG_CTRL_IFACE_MIB
+ } else if (os_strcmp(buf, "MIB") == 0) {
+ reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
+ if (reply_len >= 0) {
+@@ -11577,6 +11578,7 @@ char * wpa_supplicant_ctrl_iface_process
+ reply_size - reply_len);
+ #endif /* CONFIG_MACSEC */
+ }
++#endif
+ } else if (os_strncmp(buf, "STATUS", 6) == 0) {
+ reply_len = wpa_supplicant_ctrl_iface_status(
+ wpa_s, buf + 6, reply, reply_size);
+@@ -12065,6 +12067,7 @@ char * wpa_supplicant_ctrl_iface_process
+ reply_len = wpa_supplicant_ctrl_iface_bss(
+ wpa_s, buf + 4, reply, reply_size);
+ #ifdef CONFIG_AP
++#ifdef CONFIG_CTRL_IFACE_MIB
+ } else if (os_strcmp(buf, "STA-FIRST") == 0) {
+ reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
+ } else if (os_strncmp(buf, "STA ", 4) == 0) {
+@@ -12073,12 +12076,15 @@ char * wpa_supplicant_ctrl_iface_process
+ } else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
+ reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
+ reply_size);
++#endif
++#ifdef CONFIG_CTRL_IFACE_MIB
+ } else if (os_strncmp(buf, "DEAUTHENTICATE ", 15) == 0) {
+ if (ap_ctrl_iface_sta_deauthenticate(wpa_s, buf + 15))
+ reply_len = -1;
+ } else if (os_strncmp(buf, "DISASSOCIATE ", 13) == 0) {
+ if (ap_ctrl_iface_sta_disassociate(wpa_s, buf + 13))
+ reply_len = -1;
++#endif
+ } else if (os_strncmp(buf, "CHAN_SWITCH ", 12) == 0) {
+ if (ap_ctrl_iface_chanswitch(wpa_s, buf + 12))
+ reply_len = -1;
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -26,6 +26,7 @@
+ #include "taxonomy.h"
+ #include "wnm_ap.h"
+
++#ifdef CONFIG_CTRL_IFACE_MIB
+
+ static size_t hostapd_write_ht_mcs_bitmask(char *buf, size_t buflen,
+ size_t curr_len, const u8 *mcs_set)
+@@ -460,6 +461,7 @@ int hostapd_ctrl_iface_sta_next(struct h
+ return hostapd_ctrl_iface_sta_mib(hapd, sta->next, buf, buflen);
+ }
+
++#endif
+
+ #ifdef CONFIG_P2P_MANAGER
+ static int p2p_manager_disconnect(struct hostapd_data *hapd, u16 stype,
+@@ -832,12 +834,12 @@ int hostapd_ctrl_iface_status(struct hos
+ return len;
+ len += ret;
+ }
+-
++#ifdef CONFIG_CTRL_IFACE_MIB
+ if (iface->conf->ieee80211n && !hapd->conf->disable_11n && mode) {
+ len = hostapd_write_ht_mcs_bitmask(buf, buflen, len,
+ mode->mcs_set);
+ }
+-
++#endif /* CONFIG_CTRL_IFACE_MIB */
+ if (iface->current_rates && iface->num_rates) {
+ ret = os_snprintf(buf + len, buflen - len, "supported_rates=");
+ if (os_snprintf_error(buflen - len, ret))
+--- a/src/ap/ieee802_1x.c
++++ b/src/ap/ieee802_1x.c
+@@ -2740,6 +2740,7 @@ static const char * bool_txt(bool val)
+ return val ? "TRUE" : "FALSE";
+ }
+
++#ifdef CONFIG_CTRL_IFACE_MIB
+
+ int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
+ {
+@@ -2926,6 +2927,7 @@ int ieee802_1x_get_mib_sta(struct hostap
+ return len;
+ }
+
++#endif
+
+ #ifdef CONFIG_HS20
+ static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx)
+--- a/src/ap/wpa_auth.c
++++ b/src/ap/wpa_auth.c
+@@ -4559,6 +4559,7 @@ static const char * wpa_bool_txt(int val
+ return val ? "TRUE" : "FALSE";
+ }
+
++#ifdef CONFIG_CTRL_IFACE_MIB
+
+ #define RSN_SUITE "%02x-%02x-%02x-%d"
+ #define RSN_SUITE_ARG(s) \
+@@ -4709,7 +4710,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
+
+ return len;
+ }
+-
++#endif
+
+ void wpa_auth_countermeasures_start(struct wpa_authenticator *wpa_auth)
+ {
+--- a/src/rsn_supp/wpa.c
++++ b/src/rsn_supp/wpa.c
+@@ -2802,6 +2802,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
+ }
+
+
++#ifdef CONFIG_CTRL_IFACE_MIB
++
+ #define RSN_SUITE "%02x-%02x-%02x-%d"
+ #define RSN_SUITE_ARG(s) \
+ ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
+@@ -2883,6 +2885,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
+
+ return (int) len;
+ }
++#endif
+ #endif /* CONFIG_CTRL_IFACE */
+
+
+--- a/wpa_supplicant/ap.c
++++ b/wpa_supplicant/ap.c
+@@ -1477,7 +1477,7 @@ int wpas_ap_wps_nfc_report_handover(stru
+ #endif /* CONFIG_WPS */
+
+
+-#ifdef CONFIG_CTRL_IFACE
++#if defined(CONFIG_CTRL_IFACE) && defined(CONFIG_CTRL_IFACE_MIB)
+
+ int ap_ctrl_iface_sta_first(struct wpa_supplicant *wpa_s,
+ char *buf, size_t buflen)
diff --git a/recipes-wifi/hostapd/files/patches-2.11/381-hostapd_cli_UNKNOWN-COMMAND.patch b/recipes-wifi/hostapd/files/patches-2.11/381-hostapd_cli_UNKNOWN-COMMAND.patch
new file mode 100644
index 0000000..d2414fa
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/381-hostapd_cli_UNKNOWN-COMMAND.patch
@@ -0,0 +1,11 @@
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -744,7 +744,7 @@ static int wpa_ctrl_command_sta(struct w
+ }
+
+ buf[len] = '\0';
+- if (memcmp(buf, "FAIL", 4) == 0)
++ if (memcmp(buf, "FAIL", 4) == 0 || memcmp(buf, "UNKNOWN COMMAND", 15) == 0)
+ return -1;
+ if (print)
+ printf("%s", buf);
diff --git a/recipes-wifi/hostapd/files/patches-2.11/390-wpa_ie_cap_workaround.patch b/recipes-wifi/hostapd/files/patches-2.11/390-wpa_ie_cap_workaround.patch
new file mode 100644
index 0000000..bf481c3
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/390-wpa_ie_cap_workaround.patch
@@ -0,0 +1,56 @@
+--- a/src/common/wpa_common.c
++++ b/src/common/wpa_common.c
+@@ -2529,6 +2529,31 @@ u32 wpa_akm_to_suite(int akm)
+ }
+
+
++static void wpa_fixup_wpa_ie_rsn(u8 *assoc_ie, const u8 *wpa_msg_ie,
++ size_t rsn_ie_len)
++{
++ int pos, count;
++
++ pos = sizeof(struct rsn_ie_hdr) + RSN_SELECTOR_LEN;
++ if (rsn_ie_len < pos + 2)
++ return;
++
++ count = WPA_GET_LE16(wpa_msg_ie + pos);
++ pos += 2 + count * RSN_SELECTOR_LEN;
++ if (rsn_ie_len < pos + 2)
++ return;
++
++ count = WPA_GET_LE16(wpa_msg_ie + pos);
++ pos += 2 + count * RSN_SELECTOR_LEN;
++ if (rsn_ie_len < pos + 2)
++ return;
++
++ if (!assoc_ie[pos] && !assoc_ie[pos + 1] &&
++ (wpa_msg_ie[pos] || wpa_msg_ie[pos + 1]))
++ memcpy(&assoc_ie[pos], &wpa_msg_ie[pos], 2);
++}
++
++
+ int wpa_compare_rsn_ie(int ft_initial_assoc,
+ const u8 *ie1, size_t ie1len,
+ const u8 *ie2, size_t ie2len)
+@@ -2536,8 +2561,19 @@ int wpa_compare_rsn_ie(int ft_initial_as
+ if (ie1 == NULL || ie2 == NULL)
+ return -1;
+
+- if (ie1len == ie2len && os_memcmp(ie1, ie2, ie1len) == 0)
+- return 0; /* identical IEs */
++ if (ie1len == ie2len) {
++ u8 *ie_tmp;
++
++ if (os_memcmp(ie1, ie2, ie1len) == 0)
++ return 0; /* identical IEs */
++
++ ie_tmp = alloca(ie1len);
++ memcpy(ie_tmp, ie1, ie1len);
++ wpa_fixup_wpa_ie_rsn(ie_tmp, ie2, ie1len);
++
++ if (os_memcmp(ie_tmp, ie2, ie1len) == 0)
++ return 0; /* only mismatch in RSN capabilties */
++ }
+
+ #ifdef CONFIG_IEEE80211R
+ if (ft_initial_assoc) {
diff --git a/recipes-wifi/hostapd/files/patches-2.11/400-wps_single_auth_enc_type.patch b/recipes-wifi/hostapd/files/patches-2.11/400-wps_single_auth_enc_type.patch
new file mode 100644
index 0000000..edcd985
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/400-wps_single_auth_enc_type.patch
@@ -0,0 +1,23 @@
+--- a/src/ap/wps_hostapd.c
++++ b/src/ap/wps_hostapd.c
+@@ -394,9 +394,8 @@ static int hapd_wps_reconfig_in_memory(s
+ bss->wpa_pairwise |= WPA_CIPHER_GCMP;
+ else
+ bss->wpa_pairwise |= WPA_CIPHER_CCMP;
+- }
+ #ifndef CONFIG_NO_TKIP
+- if (cred->encr_type & WPS_ENCR_TKIP)
++ } else if (cred->encr_type & WPS_ENCR_TKIP)
+ bss->wpa_pairwise |= WPA_CIPHER_TKIP;
+ #endif /* CONFIG_NO_TKIP */
+ bss->rsn_pairwise = bss->wpa_pairwise;
+@@ -1181,8 +1180,7 @@ int hostapd_init_wps(struct hostapd_data
+ WPA_CIPHER_GCMP_256)) {
+ wps->encr_types |= WPS_ENCR_AES;
+ wps->encr_types_rsn |= WPS_ENCR_AES;
+- }
+- if (conf->rsn_pairwise & WPA_CIPHER_TKIP) {
++ } else if (conf->rsn_pairwise & WPA_CIPHER_TKIP) {
+ #ifdef CONFIG_NO_TKIP
+ wpa_printf(MSG_INFO, "WPS: TKIP not supported");
+ goto fail;
diff --git a/recipes-wifi/hostapd/files/patches-2.11/410-limit_debug_messages.patch b/recipes-wifi/hostapd/files/patches-2.11/410-limit_debug_messages.patch
new file mode 100644
index 0000000..d2713fc
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/410-limit_debug_messages.patch
@@ -0,0 +1,210 @@
+--- a/src/utils/wpa_debug.c
++++ b/src/utils/wpa_debug.c
+@@ -206,7 +206,7 @@ void wpa_debug_close_linux_tracing(void)
+ *
+ * Note: New line '\n' is added to the end of the text when printing to stdout.
+ */
+-void wpa_printf(int level, const char *fmt, ...)
++void _wpa_printf(int level, const char *fmt, ...)
+ {
+ va_list ap;
+
+@@ -255,7 +255,7 @@ void wpa_printf(int level, const char *f
+ }
+
+
+-static void _wpa_hexdump(int level, const char *title, const u8 *buf,
++void _wpa_hexdump(int level, const char *title, const u8 *buf,
+ size_t len, int show, int only_syslog)
+ {
+ size_t i;
+@@ -382,19 +382,7 @@ static void _wpa_hexdump(int level, cons
+ #endif /* CONFIG_ANDROID_LOG */
+ }
+
+-void wpa_hexdump(int level, const char *title, const void *buf, size_t len)
+-{
+- _wpa_hexdump(level, title, buf, len, 1, 0);
+-}
+-
+-
+-void wpa_hexdump_key(int level, const char *title, const void *buf, size_t len)
+-{
+- _wpa_hexdump(level, title, buf, len, wpa_debug_show_keys, 0);
+-}
+-
+-
+-static void _wpa_hexdump_ascii(int level, const char *title, const void *buf,
++void _wpa_hexdump_ascii(int level, const char *title, const void *buf,
+ size_t len, int show)
+ {
+ size_t i, llen;
+@@ -507,20 +495,6 @@ file_done:
+ }
+
+
+-void wpa_hexdump_ascii(int level, const char *title, const void *buf,
+- size_t len)
+-{
+- _wpa_hexdump_ascii(level, title, buf, len, 1);
+-}
+-
+-
+-void wpa_hexdump_ascii_key(int level, const char *title, const void *buf,
+- size_t len)
+-{
+- _wpa_hexdump_ascii(level, title, buf, len, wpa_debug_show_keys);
+-}
+-
+-
+ #ifdef CONFIG_DEBUG_FILE
+ static char *last_path = NULL;
+ #endif /* CONFIG_DEBUG_FILE */
+@@ -636,7 +610,7 @@ void wpa_msg_register_ifname_cb(wpa_msg_
+ }
+
+
+-void wpa_msg(void *ctx, int level, const char *fmt, ...)
++void _wpa_msg(void *ctx, int level, const char *fmt, ...)
+ {
+ va_list ap;
+ char *buf;
+@@ -674,7 +648,7 @@ void wpa_msg(void *ctx, int level, const
+ }
+
+
+-void wpa_msg_ctrl(void *ctx, int level, const char *fmt, ...)
++void _wpa_msg_ctrl(void *ctx, int level, const char *fmt, ...)
+ {
+ va_list ap;
+ char *buf;
+--- a/src/utils/wpa_debug.h
++++ b/src/utils/wpa_debug.h
+@@ -50,6 +50,17 @@ int wpa_debug_reopen_file(void);
+ void wpa_debug_close_file(void);
+ void wpa_debug_setup_stdout(void);
+
++/* internal */
++void _wpa_hexdump(int level, const char *title, const u8 *buf,
++ size_t len, int show, int only_syslog);
++void _wpa_hexdump_ascii(int level, const char *title, const void *buf,
++ size_t len, int show);
++extern int wpa_debug_show_keys;
++
++#ifndef CONFIG_MSG_MIN_PRIORITY
++#define CONFIG_MSG_MIN_PRIORITY 0
++#endif
++
+ /**
+ * wpa_debug_printf_timestamp - Print timestamp for debug output
+ *
+@@ -70,9 +81,15 @@ void wpa_debug_print_timestamp(void);
+ *
+ * Note: New line '\n' is added to the end of the text when printing to stdout.
+ */
+-void wpa_printf(int level, const char *fmt, ...)
++void _wpa_printf(int level, const char *fmt, ...)
+ PRINTF_FORMAT(2, 3);
+
++#define wpa_printf(level, ...) \
++ do { \
++ if (level >= CONFIG_MSG_MIN_PRIORITY) \
++ _wpa_printf(level, __VA_ARGS__); \
++ } while(0)
++
+ /**
+ * wpa_hexdump - conditional hex dump
+ * @level: priority level (MSG_*) of the message
+@@ -84,7 +101,13 @@ PRINTF_FORMAT(2, 3);
+ * output may be directed to stdout, stderr, and/or syslog based on
+ * configuration. The contents of buf is printed out has hex dump.
+ */
+-void wpa_hexdump(int level, const char *title, const void *buf, size_t len);
++static inline void wpa_hexdump(int level, const char *title, const void *buf, size_t len)
++{
++ if (level < CONFIG_MSG_MIN_PRIORITY)
++ return;
++
++ _wpa_hexdump(level, title, buf, len, 1, 1);
++}
+
+ static inline void wpa_hexdump_buf(int level, const char *title,
+ const struct wpabuf *buf)
+@@ -106,7 +129,13 @@ static inline void wpa_hexdump_buf(int l
+ * like wpa_hexdump(), but by default, does not include secret keys (passwords,
+ * etc.) in debug output.
+ */
+-void wpa_hexdump_key(int level, const char *title, const void *buf, size_t len);
++static inline void wpa_hexdump_key(int level, const char *title, const u8 *buf, size_t len)
++{
++ if (level < CONFIG_MSG_MIN_PRIORITY)
++ return;
++
++ _wpa_hexdump(level, title, buf, len, wpa_debug_show_keys, 1);
++}
+
+ static inline void wpa_hexdump_buf_key(int level, const char *title,
+ const struct wpabuf *buf)
+@@ -128,8 +157,14 @@ static inline void wpa_hexdump_buf_key(i
+ * the hex numbers and ASCII characters (for printable range) are shown. 16
+ * bytes per line will be shown.
+ */
+-void wpa_hexdump_ascii(int level, const char *title, const void *buf,
+- size_t len);
++static inline void wpa_hexdump_ascii(int level, const char *title,
++ const u8 *buf, size_t len)
++{
++ if (level < CONFIG_MSG_MIN_PRIORITY)
++ return;
++
++ _wpa_hexdump_ascii(level, title, buf, len, 1);
++}
+
+ /**
+ * wpa_hexdump_ascii_key - conditional hex dump, hide keys
+@@ -145,8 +180,14 @@ void wpa_hexdump_ascii(int level, const
+ * bytes per line will be shown. This works like wpa_hexdump_ascii(), but by
+ * default, does not include secret keys (passwords, etc.) in debug output.
+ */
+-void wpa_hexdump_ascii_key(int level, const char *title, const void *buf,
+- size_t len);
++static inline void wpa_hexdump_ascii_key(int level, const char *title,
++ const u8 *buf, size_t len)
++{
++ if (level < CONFIG_MSG_MIN_PRIORITY)
++ return;
++
++ _wpa_hexdump_ascii(level, title, buf, len, wpa_debug_show_keys);
++}
+
+ /*
+ * wpa_dbg() behaves like wpa_msg(), but it can be removed from build to reduce
+@@ -183,7 +224,12 @@ void wpa_hexdump_ascii_key(int level, co
+ *
+ * Note: New line '\n' is added to the end of the text when printing to stdout.
+ */
+-void wpa_msg(void *ctx, int level, const char *fmt, ...) PRINTF_FORMAT(3, 4);
++void _wpa_msg(void *ctx, int level, const char *fmt, ...) PRINTF_FORMAT(3, 4);
++#define wpa_msg(ctx, level, ...) \
++ do { \
++ if (level >= CONFIG_MSG_MIN_PRIORITY) \
++ _wpa_msg(ctx, level, __VA_ARGS__); \
++ } while(0)
+
+ /**
+ * wpa_msg_ctrl - Conditional printf for ctrl_iface monitors
+@@ -197,8 +243,13 @@ void wpa_msg(void *ctx, int level, const
+ * attached ctrl_iface monitors. In other words, it can be used for frequent
+ * events that do not need to be sent to syslog.
+ */
+-void wpa_msg_ctrl(void *ctx, int level, const char *fmt, ...)
++void _wpa_msg_ctrl(void *ctx, int level, const char *fmt, ...)
+ PRINTF_FORMAT(3, 4);
++#define wpa_msg_ctrl(ctx, level, ...) \
++ do { \
++ if (level >= CONFIG_MSG_MIN_PRIORITY) \
++ _wpa_msg_ctrl(ctx, level, __VA_ARGS__); \
++ } while(0)
+
+ /**
+ * wpa_msg_global - Global printf for ctrl_iface monitors
diff --git a/recipes-wifi/hostapd/files/patches-2.11/420-indicate-features.patch b/recipes-wifi/hostapd/files/patches-2.11/420-indicate-features.patch
new file mode 100644
index 0000000..12edb6b
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/420-indicate-features.patch
@@ -0,0 +1,63 @@
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -31,7 +31,7 @@
+ #include "config_file.h"
+ #include "eap_register.h"
+ #include "ctrl_iface.h"
+-
++#include "build_features.h"
+
+ struct hapd_global {
+ void **drv_priv;
+@@ -692,7 +692,7 @@ int main(int argc, char *argv[])
+ wpa_supplicant_event = hostapd_wpa_event;
+ wpa_supplicant_event_global = hostapd_wpa_event_global;
+ for (;;) {
+- c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:q");
++ c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:g:G:qv::");
+ if (c < 0)
+ break;
+ switch (c) {
+@@ -729,6 +729,8 @@ int main(int argc, char *argv[])
+ break;
+ #endif /* CONFIG_DEBUG_LINUX_TRACING */
+ case 'v':
++ if (optarg)
++ exit(!has_feature(optarg));
+ show_version();
+ exit(1);
+ case 'g':
+--- a/wpa_supplicant/main.c
++++ b/wpa_supplicant/main.c
+@@ -12,6 +12,7 @@
+ #endif /* __linux__ */
+
+ #include "common.h"
++#include "build_features.h"
+ #include "crypto/crypto.h"
+ #include "fst/fst.h"
+ #include "wpa_supplicant_i.h"
+@@ -203,7 +204,7 @@ int main(int argc, char *argv[])
+
+ for (;;) {
+ c = getopt(argc, argv,
+- "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuvW");
++ "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuv::W");
+ if (c < 0)
+ break;
+ switch (c) {
+@@ -306,8 +307,12 @@ int main(int argc, char *argv[])
+ break;
+ #endif /* CONFIG_CTRL_IFACE_DBUS_NEW */
+ case 'v':
+- printf("%s\n", wpa_supplicant_version);
+- exitcode = 0;
++ if (optarg) {
++ exitcode = !has_feature(optarg);
++ } else {
++ printf("%s\n", wpa_supplicant_version);
++ exitcode = 0;
++ }
+ goto out;
+ case 'W':
+ params.wait_for_monitor++;
diff --git a/recipes-wifi/hostapd/files/patches-2.11/430-hostapd_cli_ifdef.patch b/recipes-wifi/hostapd/files/patches-2.11/430-hostapd_cli_ifdef.patch
new file mode 100644
index 0000000..e524209
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/430-hostapd_cli_ifdef.patch
@@ -0,0 +1,56 @@
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -388,7 +388,6 @@ static int hostapd_cli_cmd_disassociate(
+ }
+
+
+-#ifdef CONFIG_TAXONOMY
+ static int hostapd_cli_cmd_signature(struct wpa_ctrl *ctrl, int argc,
+ char *argv[])
+ {
+@@ -401,7 +400,6 @@ static int hostapd_cli_cmd_signature(str
+ os_snprintf(buf, sizeof(buf), "SIGNATURE %s", argv[0]);
+ return wpa_ctrl_command(ctrl, buf);
+ }
+-#endif /* CONFIG_TAXONOMY */
+
+
+ static int hostapd_cli_cmd_sa_query(struct wpa_ctrl *ctrl, int argc,
+@@ -418,7 +416,6 @@ static int hostapd_cli_cmd_sa_query(stru
+ }
+
+
+-#ifdef CONFIG_WPS
+ static int hostapd_cli_cmd_wps_pin(struct wpa_ctrl *ctrl, int argc,
+ char *argv[])
+ {
+@@ -644,7 +641,6 @@ static int hostapd_cli_cmd_wps_config(st
+ ssid_hex, argv[1]);
+ return wpa_ctrl_command(ctrl, buf);
+ }
+-#endif /* CONFIG_WPS */
+
+
+ static int hostapd_cli_cmd_disassoc_imminent(struct wpa_ctrl *ctrl, int argc,
+@@ -1588,13 +1584,10 @@ static const struct hostapd_cli_cmd host
+ { "disassociate", hostapd_cli_cmd_disassociate,
+ hostapd_complete_stations,
+ "<addr> = disassociate a station" },
+-#ifdef CONFIG_TAXONOMY
+ { "signature", hostapd_cli_cmd_signature, hostapd_complete_stations,
+ "<addr> = get taxonomy signature for a station" },
+-#endif /* CONFIG_TAXONOMY */
+ { "sa_query", hostapd_cli_cmd_sa_query, hostapd_complete_stations,
+ "<addr> = send SA Query to a station" },
+-#ifdef CONFIG_WPS
+ { "wps_pin", hostapd_cli_cmd_wps_pin, NULL,
+ "<uuid> <pin> [timeout] [addr] = add WPS Enrollee PIN" },
+ { "wps_check_pin", hostapd_cli_cmd_wps_check_pin, NULL,
+@@ -1619,7 +1612,6 @@ static const struct hostapd_cli_cmd host
+ "<SSID> <auth> <encr> <key> = configure AP" },
+ { "wps_get_status", hostapd_cli_cmd_wps_get_status, NULL,
+ "= show current WPS status" },
+-#endif /* CONFIG_WPS */
+ { "disassoc_imminent", hostapd_cli_cmd_disassoc_imminent, NULL,
+ "= send Disassociation Imminent notification" },
+ { "ess_disassoc", hostapd_cli_cmd_ess_disassoc, NULL,
diff --git a/recipes-wifi/hostapd/files/patches-2.11/431-wpa_cli_ifdef.patch b/recipes-wifi/hostapd/files/patches-2.11/431-wpa_cli_ifdef.patch
new file mode 100644
index 0000000..65c31c5
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/431-wpa_cli_ifdef.patch
@@ -0,0 +1,18 @@
+--- a/wpa_supplicant/wpa_cli.c
++++ b/wpa_supplicant/wpa_cli.c
+@@ -26,6 +26,15 @@
+ #include <cutils/properties.h>
+ #endif /* ANDROID */
+
++#ifndef CONFIG_P2P
++#define CONFIG_P2P
++#endif
++#ifndef CONFIG_AP
++#define CONFIG_AP
++#endif
++#ifndef CONFIG_MESH
++#define CONFIG_MESH
++#endif
+
+ static const char *const wpa_cli_version =
+ "wpa_cli v" VERSION_STR "\n"
diff --git a/recipes-wifi/hostapd/files/patches-2.11/432-missing-typedef.patch b/recipes-wifi/hostapd/files/patches-2.11/432-missing-typedef.patch
new file mode 100644
index 0000000..7a100f1
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/432-missing-typedef.patch
@@ -0,0 +1,10 @@
+--- a/src/drivers/linux_wext.h
++++ b/src/drivers/linux_wext.h
+@@ -26,6 +26,7 @@ typedef int32_t __s32;
+ typedef uint16_t __u16;
+ typedef int16_t __s16;
+ typedef uint8_t __u8;
++typedef int8_t __s8;
+ #ifndef __user
+ #define __user
+ #endif /* __user */
diff --git a/recipes-wifi/hostapd/files/patches-2.11/450-scan_wait.patch b/recipes-wifi/hostapd/files/patches-2.11/450-scan_wait.patch
new file mode 100644
index 0000000..ac874ad
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/450-scan_wait.patch
@@ -0,0 +1,73 @@
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -39,6 +39,8 @@ struct hapd_global {
+ };
+
+ static struct hapd_global global;
++static int daemonize = 0;
++static char *pid_file = NULL;
+
+
+ #ifndef CONFIG_NO_HOSTAPD_LOGGER
+@@ -146,6 +148,14 @@ static void hostapd_logger_cb(void *ctx,
+ }
+ #endif /* CONFIG_NO_HOSTAPD_LOGGER */
+
++static void hostapd_setup_complete_cb(void *ctx)
++{
++ if (daemonize && os_daemonize(pid_file)) {
++ perror("daemon");
++ return;
++ }
++ daemonize = 0;
++}
+
+ /**
+ * hostapd_driver_init - Preparate driver interface
+@@ -164,6 +174,8 @@ static int hostapd_driver_init(struct ho
+ return -1;
+ }
+
++ hapd->setup_complete_cb = hostapd_setup_complete_cb;
++
+ /* Initialize the driver interface */
+ if (!(b[0] | b[1] | b[2] | b[3] | b[4] | b[5]))
+ b = NULL;
+@@ -404,8 +416,6 @@ static void hostapd_global_deinit(const
+ #endif /* CONFIG_NATIVE_WINDOWS */
+
+ eap_server_unregister_methods();
+-
+- os_daemonize_terminate(pid_file);
+ }
+
+
+@@ -431,18 +441,6 @@ static int hostapd_global_run(struct hap
+ }
+ #endif /* EAP_SERVER_TNC */
+
+- if (daemonize) {
+- if (os_daemonize(pid_file)) {
+- wpa_printf(MSG_ERROR, "daemon: %s", strerror(errno));
+- return -1;
+- }
+- if (eloop_sock_requeue()) {
+- wpa_printf(MSG_ERROR, "eloop_sock_requeue: %s",
+- strerror(errno));
+- return -1;
+- }
+- }
+-
+ eloop_run();
+
+ return 0;
+@@ -645,8 +643,7 @@ int main(int argc, char *argv[])
+ struct hapd_interfaces interfaces;
+ int ret = 1;
+ size_t i, j;
+- int c, debug = 0, daemonize = 0;
+- char *pid_file = NULL;
++ int c, debug = 0;
+ const char *log_file = NULL;
+ const char *entropy_file = NULL;
+ char **bss_config = NULL, **tmp_bss;
diff --git a/recipes-wifi/hostapd/files/patches-2.11/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch b/recipes-wifi/hostapd/files/patches-2.11/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
new file mode 100644
index 0000000..38ff663
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
@@ -0,0 +1,189 @@
+From 4bb69d15477e0f2b00e166845341dc933de47c58 Mon Sep 17 00:00:00 2001
+From: Antonio Quartulli <ordex@autistici.org>
+Date: Sun, 3 Jun 2012 18:22:56 +0200
+Subject: [PATCHv2 601/602] wpa_supplicant: add new config params to be used
+ with the ibss join command
+
+Signed-hostap: Antonio Quartulli <ordex@autistici.org>
+---
+ src/drivers/driver.h | 6 +++
+ wpa_supplicant/config.c | 96 +++++++++++++++++++++++++++++++++++++++
+ wpa_supplicant/config_ssid.h | 6 +++
+ wpa_supplicant/wpa_supplicant.c | 23 +++++++---
+ 4 files changed, 124 insertions(+), 7 deletions(-)
+
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -19,6 +19,7 @@
+
+ #define WPA_SUPPLICANT_DRIVER_VERSION 4
+
++#include "ap/sta_info.h"
+ #include "common/defs.h"
+ #include "common/ieee802_11_defs.h"
+ #include "common/wpa_common.h"
+@@ -894,6 +895,9 @@ struct wpa_driver_associate_params {
+ * responsible for selecting with which BSS to associate. */
+ const u8 *bssid;
+
++ unsigned char rates[WLAN_SUPP_RATES_MAX];
++ int mcast_rate;
++
+ /**
+ * bssid_hint - BSSID of a proposed AP
+ *
+--- a/wpa_supplicant/config.c
++++ b/wpa_supplicant/config.c
+@@ -18,6 +18,7 @@
+ #include "eap_peer/eap.h"
+ #include "p2p/p2p.h"
+ #include "fst/fst.h"
++#include "ap/sta_info.h"
+ #include "config.h"
+
+
+@@ -2345,6 +2346,97 @@ static char * wpa_config_write_peerkey(c
+ #endif /* NO_CONFIG_WRITE */
+
+
++static int wpa_config_parse_mcast_rate(const struct parse_data *data,
++ struct wpa_ssid *ssid, int line,
++ const char *value)
++{
++ ssid->mcast_rate = (int)(strtod(value, NULL) * 10);
++
++ return 0;
++}
++
++#ifndef NO_CONFIG_WRITE
++static char * wpa_config_write_mcast_rate(const struct parse_data *data,
++ struct wpa_ssid *ssid)
++{
++ char *value;
++ int res;
++
++ if (!ssid->mcast_rate == 0)
++ return NULL;
++
++ value = os_malloc(6); /* longest: 300.0 */
++ if (value == NULL)
++ return NULL;
++ res = os_snprintf(value, 5, "%.1f", (double)ssid->mcast_rate / 10);
++ if (res < 0) {
++ os_free(value);
++ return NULL;
++ }
++ return value;
++}
++#endif /* NO_CONFIG_WRITE */
++
++static int wpa_config_parse_rates(const struct parse_data *data,
++ struct wpa_ssid *ssid, int line,
++ const char *value)
++{
++ int i;
++ char *pos, *r, *sptr, *end;
++ double rate;
++
++ pos = (char *)value;
++ r = strtok_r(pos, ",", &sptr);
++ i = 0;
++ while (pos && i < WLAN_SUPP_RATES_MAX) {
++ rate = 0.0;
++ if (r)
++ rate = strtod(r, &end);
++ ssid->rates[i] = rate * 2;
++ if (*end != '\0' || rate * 2 != ssid->rates[i])
++ return 1;
++
++ i++;
++ r = strtok_r(NULL, ",", &sptr);
++ }
++
++ return 0;
++}
++
++#ifndef NO_CONFIG_WRITE
++static char * wpa_config_write_rates(const struct parse_data *data,
++ struct wpa_ssid *ssid)
++{
++ char *value, *pos;
++ int res, i;
++
++ if (ssid->rates[0] <= 0)
++ return NULL;
++
++ value = os_malloc(6 * WLAN_SUPP_RATES_MAX + 1);
++ if (value == NULL)
++ return NULL;
++ pos = value;
++ for (i = 0; i < WLAN_SUPP_RATES_MAX - 1; i++) {
++ res = os_snprintf(pos, 6, "%.1f,", (double)ssid->rates[i] / 2);
++ if (res < 0) {
++ os_free(value);
++ return NULL;
++ }
++ pos += res;
++ }
++ res = os_snprintf(pos, 6, "%.1f",
++ (double)ssid->rates[WLAN_SUPP_RATES_MAX - 1] / 2);
++ if (res < 0) {
++ os_free(value);
++ return NULL;
++ }
++
++ value[6 * WLAN_SUPP_RATES_MAX] = '\0';
++ return value;
++}
++#endif /* NO_CONFIG_WRITE */
++
+ /* Helper macros for network block parser */
+
+ #ifdef OFFSET
+@@ -2629,6 +2721,8 @@ static const struct parse_data ssid_fiel
+ { INT(ap_max_inactivity) },
+ { INT(dtim_period) },
+ { INT(beacon_int) },
++ { FUNC(rates) },
++ { FUNC(mcast_rate) },
+ #ifdef CONFIG_MACSEC
+ { INT_RANGE(macsec_policy, 0, 1) },
+ { INT_RANGE(macsec_integ_only, 0, 1) },
+--- a/wpa_supplicant/config_ssid.h
++++ b/wpa_supplicant/config_ssid.h
+@@ -10,8 +10,10 @@
+ #define CONFIG_SSID_H
+
+ #include "common/defs.h"
++#include "ap/sta_info.h"
+ #include "utils/list.h"
+ #include "eap_peer/eap_config.h"
++#include "drivers/nl80211_copy.h"
+
+
+ #define DEFAULT_EAP_WORKAROUND ((unsigned int) -1)
+@@ -846,6 +848,9 @@ struct wpa_ssid {
+ */
+ void *parent_cred;
+
++ unsigned char rates[WLAN_SUPP_RATES_MAX];
++ double mcast_rate;
++
+ #ifdef CONFIG_MACSEC
+ /**
+ * macsec_policy - Determines the policy for MACsec secure session
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -3899,6 +3899,12 @@ static void wpas_start_assoc_cb(struct w
+ params.beacon_int = ssid->beacon_int;
+ else
+ params.beacon_int = wpa_s->conf->beacon_int;
++ int i = 0;
++ while (i < WLAN_SUPP_RATES_MAX) {
++ params.rates[i] = ssid->rates[i];
++ i++;
++ }
++ params.mcast_rate = ssid->mcast_rate;
+ }
+
+ if (bss && ssid->enable_edmg)
diff --git a/recipes-wifi/hostapd/files/patches-2.11/461-driver_nl80211-use-new-parameters-during-ibss-join.patch b/recipes-wifi/hostapd/files/patches-2.11/461-driver_nl80211-use-new-parameters-during-ibss-join.patch
new file mode 100644
index 0000000..65d67b8
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/461-driver_nl80211-use-new-parameters-during-ibss-join.patch
@@ -0,0 +1,59 @@
+From ffc4445958a3ed4064f2e1bf73fa478a61c5cf7b Mon Sep 17 00:00:00 2001
+From: Antonio Quartulli <ordex@autistici.org>
+Date: Sun, 3 Jun 2012 18:42:25 +0200
+Subject: [PATCHv2 602/602] driver_nl80211: use new parameters during ibss join
+
+Signed-hostap: Antonio Quartulli <ordex@autistici.org>
+---
+ src/drivers/driver_nl80211.c | 33 ++++++++++++++++++++++++++++++++-
+ 1 file changed, 32 insertions(+), 1 deletion(-)
+
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -6005,7 +6005,7 @@ static int wpa_driver_nl80211_ibss(struc
+ struct wpa_driver_associate_params *params)
+ {
+ struct nl_msg *msg;
+- int ret = -1;
++ int ret = -1, i;
+ int count = 0;
+
+ wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
+@@ -6032,6 +6032,37 @@ retry:
+ nl80211_put_beacon_int(msg, params->beacon_int))
+ goto fail;
+
++ if (params->fixed_freq) {
++ wpa_printf(MSG_DEBUG, " * fixed_freq");
++ nla_put_flag(msg, NL80211_ATTR_FREQ_FIXED);
++ }
++
++ if (params->beacon_int > 0) {
++ wpa_printf(MSG_DEBUG, " * beacon_int=%d",
++ params->beacon_int);
++ nla_put_u32(msg, NL80211_ATTR_BEACON_INTERVAL,
++ params->beacon_int);
++ }
++
++ if (params->rates[0] > 0) {
++ wpa_printf(MSG_DEBUG, " * basic_rates:");
++ i = 0;
++ while (i < NL80211_MAX_SUPP_RATES &&
++ params->rates[i] > 0) {
++ wpa_printf(MSG_DEBUG, " %.1f",
++ (double)params->rates[i] / 2);
++ i++;
++ }
++ nla_put(msg, NL80211_ATTR_BSS_BASIC_RATES, i,
++ params->rates);
++ }
++
++ if (params->mcast_rate > 0) {
++ wpa_printf(MSG_DEBUG, " * mcast_rate=%.1f",
++ (double)params->mcast_rate / 10);
++ nla_put_u32(msg, NL80211_ATTR_MCAST_RATE, params->mcast_rate);
++ }
++
+ ret = nl80211_set_conn_keys(params, msg);
+ if (ret)
+ goto fail;
diff --git a/recipes-wifi/hostapd/files/patches-2.11/463-add-mcast_rate-to-11s.patch b/recipes-wifi/hostapd/files/patches-2.11/463-add-mcast_rate-to-11s.patch
new file mode 100644
index 0000000..5dc19fe
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/463-add-mcast_rate-to-11s.patch
@@ -0,0 +1,68 @@
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Thu, 11 May 2017 08:21:45 +0200
+Subject: [PATCH] set mcast_rate in mesh mode
+
+The wpa_supplicant code for IBSS allows to set the mcast rate. It is
+recommended to increase this value from 1 or 6 Mbit/s to something higher
+when using a mesh protocol on top which uses the multicast packet loss as
+indicator for the link quality.
+
+This setting was unfortunately not applied for mesh mode. But it would be
+beneficial when wpa_supplicant would behave similar to IBSS mode and set
+this argument during mesh join like authsae already does. At least it is
+helpful for companies/projects which are currently switching to 802.11s
+(without mesh_fwding and with mesh_ttl set to 1) as replacement for IBSS
+because newer drivers seem to support 802.11s but not IBSS anymore.
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
+
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1661,6 +1661,7 @@ struct wpa_driver_mesh_join_params {
+ #define WPA_DRIVER_MESH_FLAG_AMPE 0x00000008
+ unsigned int flags;
+ bool handle_dfs;
++ int mcast_rate;
+ };
+
+ struct wpa_driver_set_key_params {
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -10627,6 +10627,18 @@ static int nl80211_put_mesh_id(struct nl
+ }
+
+
++static int nl80211_put_mcast_rate(struct nl_msg *msg, int mcast_rate)
++{
++ if (mcast_rate > 0) {
++ wpa_printf(MSG_DEBUG, " * mcast_rate=%.1f",
++ (double)mcast_rate / 10);
++ return nla_put_u32(msg, NL80211_ATTR_MCAST_RATE, mcast_rate);
++ }
++
++ return 0;
++}
++
++
+ static int nl80211_put_mesh_config(struct nl_msg *msg,
+ struct wpa_driver_mesh_bss_params *params)
+ {
+@@ -10688,6 +10700,7 @@ static int nl80211_join_mesh(struct i802
+ nl80211_put_basic_rates(msg, params->basic_rates) ||
+ nl80211_put_mesh_id(msg, params->meshid, params->meshid_len) ||
+ nl80211_put_beacon_int(msg, params->beacon_int) ||
++ nl80211_put_mcast_rate(msg, params->mcast_rate) ||
+ nl80211_put_dtim_period(msg, params->dtim_period))
+ goto fail;
+
+--- a/wpa_supplicant/mesh.c
++++ b/wpa_supplicant/mesh.c
+@@ -632,6 +632,7 @@ int wpa_supplicant_join_mesh(struct wpa_
+
+ params->meshid = ssid->ssid;
+ params->meshid_len = ssid->ssid_len;
++ params->mcast_rate = ssid->mcast_rate;
+ ibss_mesh_setup_freq(wpa_s, ssid, ¶ms->freq);
+ wpa_s->mesh_ht_enabled = !!params->freq.ht_enabled;
+ wpa_s->mesh_vht_enabled = !!params->freq.vht_enabled;
diff --git a/recipes-wifi/hostapd/files/patches-2.11/464-fix-mesh-obss-check.patch b/recipes-wifi/hostapd/files/patches-2.11/464-fix-mesh-obss-check.patch
new file mode 100644
index 0000000..48086ea
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/464-fix-mesh-obss-check.patch
@@ -0,0 +1,19 @@
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -2539,11 +2539,13 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ for (j = 0; j < wpa_s->last_scan_res_used; j++) {
+ struct wpa_bss *bss = wpa_s->last_scan_res[j];
+
+- if (ssid->mode != WPAS_MODE_IBSS)
++ /* Don't adjust control freq in case of fixed_freq */
++ if (ssid->fixed_freq) {
++ obss_scan = 0;
+ break;
++ }
+
+- /* Don't adjust control freq in case of fixed_freq */
+- if (ssid->fixed_freq)
++ if (ssid->mode != WPAS_MODE_IBSS)
+ break;
+
+ if (!bss_is_ibss(bss))
diff --git a/recipes-wifi/hostapd/files/patches-2.11/465-hostapd-config-support-random-BSS-color.patch b/recipes-wifi/hostapd/files/patches-2.11/465-hostapd-config-support-random-BSS-color.patch
new file mode 100644
index 0000000..6810b79
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/465-hostapd-config-support-random-BSS-color.patch
@@ -0,0 +1,24 @@
+From c9304d3303d563ad6d2619f4e07864ed12f96889 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 14 May 2022 21:41:03 +0200
+Subject: [PATCH] hostapd: config: support random BSS color
+
+Configure the HE BSS color to a random value in case the config defines
+a BSS color which exceeds the max BSS color (63).
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ hostapd/config_file.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3489,6 +3489,8 @@ static int hostapd_config_fill(struct ho
+ } else if (os_strcmp(buf, "he_bss_color") == 0) {
+ conf->he_op.he_bss_color = atoi(pos) & 0x3f;
+ conf->he_op.he_bss_color_disabled = 0;
++ if (atoi(pos) > 63)
++ conf->he_op.he_bss_color = os_random() % 63 + 1;
+ } else if (os_strcmp(buf, "he_bss_color_partial") == 0) {
+ conf->he_op.he_bss_color_partial = atoi(pos);
+ } else if (os_strcmp(buf, "he_default_pe_duration") == 0) {
diff --git a/recipes-wifi/hostapd/files/patches-2.11/470-survey_data_fallback.patch b/recipes-wifi/hostapd/files/patches-2.11/470-survey_data_fallback.patch
new file mode 100644
index 0000000..359b5f3
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/470-survey_data_fallback.patch
@@ -0,0 +1,25 @@
+--- a/src/ap/acs.c
++++ b/src/ap/acs.c
+@@ -420,20 +420,19 @@ static int acs_usable_bw160_chan(const s
+ static int acs_survey_is_sufficient(struct freq_survey *survey)
+ {
+ if (!(survey->filled & SURVEY_HAS_NF)) {
++ survey->nf = -95;
+ wpa_printf(MSG_INFO, "ACS: Survey is missing noise floor");
+- return 0;
+ }
+
+ if (!(survey->filled & SURVEY_HAS_CHAN_TIME)) {
++ survey->channel_time = 0;
+ wpa_printf(MSG_INFO, "ACS: Survey is missing channel time");
+- return 0;
+ }
+
+ if (!(survey->filled & SURVEY_HAS_CHAN_TIME_BUSY) &&
+ !(survey->filled & SURVEY_HAS_CHAN_TIME_RX)) {
+ wpa_printf(MSG_INFO,
+ "ACS: Survey is missing RX and busy time (at least one is required)");
+- return 0;
+ }
+
+ return 1;
diff --git a/recipes-wifi/hostapd/files/patches-2.11/500-lto-jobserver-support.patch b/recipes-wifi/hostapd/files/patches-2.11/500-lto-jobserver-support.patch
new file mode 100644
index 0000000..e0458b2
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/500-lto-jobserver-support.patch
@@ -0,0 +1,59 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -1307,7 +1307,7 @@ hostapd_multi.a: $(BCHECK) $(OBJS)
+ @$(AR) cr $@ hostapd_multi.o $(OBJS)
+
+ hostapd: $(OBJS)
+- $(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
++ +$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
+ @$(E) " LD " $@
+
+ ifdef CONFIG_WPA_TRACE
+@@ -1318,7 +1318,7 @@ _OBJS_VAR := OBJS_c
+ include ../src/objs.mk
+
+ hostapd_cli: $(OBJS_c)
+- $(Q)$(CC) $(LDFLAGS) -o hostapd_cli $(OBJS_c) $(LIBS_c)
++ +$(Q)$(CC) $(LDFLAGS) -o hostapd_cli $(OBJS_c) $(LIBS_c)
+ @$(E) " LD " $@
+
+ NOBJS = nt_password_hash.o ../src/crypto/ms_funcs.o $(SHA1OBJS)
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -1949,31 +1949,31 @@ wpa_supplicant_multi.a: .config $(BCHECK
+ @$(AR) cr $@ wpa_supplicant_multi.o $(OBJS)
+
+ wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
+- $(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
++ +$(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
+ @$(E) " LD " $@
+
+ _OBJS_VAR := OBJS_t
+ include ../src/objs.mk
+ eapol_test: $(OBJS_t)
+- $(Q)$(LDO) $(LDFLAGS) -o eapol_test $(OBJS_t) $(LIBS)
++ +$(Q)$(LDO) $(LDFLAGS) -o eapol_test $(OBJS_t) $(LIBS)
+ @$(E) " LD " $@
+
+ _OBJS_VAR := OBJS_t2
+ include ../src/objs.mk
+ preauth_test: $(OBJS_t2)
+- $(Q)$(LDO) $(LDFLAGS) -o preauth_test $(OBJS_t2) $(LIBS)
++ +$(Q)$(LDO) $(LDFLAGS) -o preauth_test $(OBJS_t2) $(LIBS)
+ @$(E) " LD " $@
+
+ _OBJS_VAR := OBJS_p
+ include ../src/objs.mk
+ wpa_passphrase: $(OBJS_p)
+- $(Q)$(LDO) $(LDFLAGS) -o wpa_passphrase $(OBJS_p) $(LIBS_p) $(LIBS)
++ +$(Q)$(LDO) $(LDFLAGS) -o wpa_passphrase $(OBJS_p) $(LIBS_p) $(LIBS)
+ @$(E) " LD " $@
+
+ _OBJS_VAR := OBJS_c
+ include ../src/objs.mk
+ wpa_cli: $(OBJS_c)
+- $(Q)$(LDO) $(LDFLAGS) -o wpa_cli $(OBJS_c) $(LIBS_c)
++ +$(Q)$(LDO) $(LDFLAGS) -o wpa_cli $(OBJS_c) $(LIBS_c)
+ @$(E) " LD " $@
+
+ LIBCTRL += ../src/common/wpa_ctrl.o
diff --git a/recipes-wifi/hostapd/files/patches-2.11/590-rrm-wnm-statistics.patch b/recipes-wifi/hostapd/files/patches-2.11/590-rrm-wnm-statistics.patch
new file mode 100644
index 0000000..98b8820
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/590-rrm-wnm-statistics.patch
@@ -0,0 +1,92 @@
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -162,6 +162,21 @@ struct hostapd_sae_commit_queue {
+ };
+
+ /**
++ * struct hostapd_openwrt_stats - OpenWrt custom STA/AP statistics
++ */
++struct hostapd_openwrt_stats {
++ struct {
++ u64 neighbor_report_tx;
++ } rrm;
++
++ struct {
++ u64 bss_transition_query_rx;
++ u64 bss_transition_request_tx;
++ u64 bss_transition_response_rx;
++ } wnm;
++};
++
++/**
+ * struct hostapd_data - hostapd per-BSS data structure
+ */
+ struct hostapd_data {
+@@ -175,6 +190,9 @@ struct hostapd_data {
+
+ u8 own_addr[ETH_ALEN];
+
++ /* OpenWrt specific statistics */
++ struct hostapd_openwrt_stats openwrt_stats;
++
+ int num_sta; /* number of entries in sta_list */
+ struct sta_info *sta_list; /* STA info list head */
+ #define STA_HASH_SIZE 256
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -386,6 +386,7 @@ static int ieee802_11_send_bss_trans_mgm
+ mgmt->u.action.u.bss_tm_req.validity_interval = 1;
+ pos = mgmt->u.action.u.bss_tm_req.variable;
+
++ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
+ MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
+ "validity_interval=%u",
+@@ -659,10 +660,12 @@ int ieee802_11_rx_wnm_action_ap(struct h
+
+ switch (action) {
+ case WNM_BSS_TRANS_MGMT_QUERY:
++ hapd->openwrt_stats.wnm.bss_transition_query_rx++;
+ ieee802_11_rx_bss_trans_mgmt_query(hapd, mgmt->sa, payload,
+ plen);
+ return 0;
+ case WNM_BSS_TRANS_MGMT_RESP:
++ hapd->openwrt_stats.wnm.bss_transition_response_rx++;
+ ieee802_11_rx_bss_trans_mgmt_resp(hapd, mgmt->sa, payload,
+ plen);
+ return 0;
+@@ -709,6 +712,7 @@ int wnm_send_disassoc_imminent(struct ho
+
+ pos = mgmt->u.action.u.bss_tm_req.variable;
+
++ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request frame to indicate imminent disassociation (disassoc_timer=%d) to "
+ MACSTR, disassoc_timer, MAC2STR(sta->addr));
+ if (hostapd_drv_send_mlme(hapd, buf, pos - buf, 0, NULL, 0, 0) < 0) {
+@@ -790,6 +794,7 @@ int wnm_send_ess_disassoc_imminent(struc
+ return -1;
+ }
+
++ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ if (disassoc_timer) {
+ /* send disassociation frame after time-out */
+ set_disassoc_timer(hapd, sta, disassoc_timer);
+@@ -870,6 +875,7 @@ int wnm_send_bss_tm_req(struct hostapd_d
+ }
+ os_free(buf);
+
++ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ if (disassoc_timer) {
+ /* send disassociation frame after time-out */
+ set_disassoc_timer(hapd, sta, disassoc_timer);
+--- a/src/ap/rrm.c
++++ b/src/ap/rrm.c
+@@ -269,6 +269,8 @@ static void hostapd_send_nei_report_resp
+ }
+ }
+
++ hapd->openwrt_stats.rrm.neighbor_report_tx++;
++
+ hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr,
+ wpabuf_head(buf), wpabuf_len(buf));
+ wpabuf_free(buf);
diff --git a/recipes-wifi/hostapd/files/patches-2.11/599-wpa_supplicant-fix-warnings.patch b/recipes-wifi/hostapd/files/patches-2.11/599-wpa_supplicant-fix-warnings.patch
new file mode 100644
index 0000000..e70dc61
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/599-wpa_supplicant-fix-warnings.patch
@@ -0,0 +1,19 @@
+--- a/wpa_supplicant/wps_supplicant.h
++++ b/wpa_supplicant/wps_supplicant.h
+@@ -9,6 +9,7 @@
+ #ifndef WPS_SUPPLICANT_H
+ #define WPS_SUPPLICANT_H
+
++struct wpa_bss;
+ struct wpa_scan_results;
+
+ #ifdef CONFIG_WPS
+@@ -16,8 +17,6 @@ struct wpa_scan_results;
+ #include "wps/wps.h"
+ #include "wps/wps_defs.h"
+
+-struct wpa_bss;
+-
+ struct wps_new_ap_settings {
+ const char *ssid_hex;
+ const char *auth;
diff --git a/recipes-wifi/hostapd/files/patches-2.11/600-ubus_support.patch b/recipes-wifi/hostapd/files/patches-2.11/600-ubus_support.patch
new file mode 100644
index 0000000..521e7df
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/600-ubus_support.patch
@@ -0,0 +1,619 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -166,6 +166,11 @@ OBJS += ../src/common/hw_features_common
+
+ OBJS += ../src/eapol_auth/eapol_auth_sm.o
+
++ifdef CONFIG_UBUS
++CFLAGS += -DUBUS_SUPPORT
++OBJS += ../src/ap/ubus.o
++LIBS += -lubox -lubus
++endif
+
+ ifdef CONFIG_CODE_COVERAGE
+ CFLAGS += -O0 -fprofile-arcs -ftest-coverage
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -18,6 +18,7 @@
+ #include "utils/list.h"
+ #include "ap_config.h"
+ #include "drivers/driver.h"
++#include "ubus.h"
+
+ #define OCE_STA_CFON_ENABLED(hapd) \
+ ((hapd->conf->oce & OCE_STA_CFON) && \
+@@ -92,7 +93,7 @@ struct hapd_interfaces {
+ #ifdef CONFIG_CTRL_IFACE_UDP
+ unsigned char ctrl_iface_cookie[CTRL_IFACE_COOKIE_LEN];
+ #endif /* CONFIG_CTRL_IFACE_UDP */
+-
++ struct ubus_object ubus;
+ };
+
+ enum hostapd_chan_status {
+@@ -183,6 +184,7 @@ struct hostapd_data {
+ struct hostapd_iface *iface;
+ struct hostapd_config *iconf;
+ struct hostapd_bss_config *conf;
++ struct hostapd_ubus_bss ubus;
+ int interface_added; /* virtual interface added for this BSS */
+ unsigned int started:1;
+ unsigned int disabled:1;
+@@ -673,6 +675,7 @@ hostapd_alloc_bss_data(struct hostapd_if
+ struct hostapd_bss_config *bss);
+ int hostapd_setup_interface(struct hostapd_iface *iface);
+ int hostapd_setup_interface_complete(struct hostapd_iface *iface, int err);
++void hostapd_set_own_neighbor_report(struct hostapd_data *hapd);
+ void hostapd_interface_deinit(struct hostapd_iface *iface);
+ void hostapd_interface_free(struct hostapd_iface *iface);
+ struct hostapd_iface * hostapd_alloc_iface(void);
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -401,6 +401,7 @@ void hostapd_free_hapd_data(struct hosta
+ hapd->beacon_set_done = 0;
+
+ wpa_printf(MSG_DEBUG, "%s(%s)", __func__, hapd->conf->iface);
++ hostapd_ubus_free_bss(hapd);
+ accounting_deinit(hapd);
+ hostapd_deinit_wpa(hapd);
+ vlan_deinit(hapd);
+@@ -1431,6 +1432,8 @@ static int hostapd_setup_bss(struct host
+ if (hapd->driver && hapd->driver->set_operstate)
+ hapd->driver->set_operstate(hapd->drv_priv, 1);
+
++ hostapd_ubus_add_bss(hapd);
++
+ return 0;
+ }
+
+@@ -2050,6 +2053,7 @@ static int hostapd_setup_interface_compl
+ if (err)
+ goto fail;
+
++ hostapd_ubus_add_iface(iface);
+ wpa_printf(MSG_DEBUG, "Completing interface initialization");
+ if (iface->freq) {
+ #ifdef NEED_AP_MLME
+@@ -2248,6 +2252,7 @@ dfs_offload:
+
+ fail:
+ wpa_printf(MSG_ERROR, "Interface initialization failed");
++ hostapd_ubus_free_iface(iface);
+ hostapd_set_state(iface, HAPD_IFACE_DISABLED);
+ wpa_msg(hapd->msg_ctx, MSG_INFO, AP_EVENT_DISABLED);
+ #ifdef CONFIG_FST
+@@ -2723,6 +2728,7 @@ void hostapd_interface_deinit_free(struc
+ (unsigned int) iface->conf->num_bss);
+ driver = iface->bss[0]->driver;
+ drv_priv = iface->bss[0]->drv_priv;
++ hostapd_ubus_free_iface(iface);
+ hostapd_interface_deinit(iface);
+ wpa_printf(MSG_DEBUG, "%s: driver=%p drv_priv=%p -> hapd_deinit",
+ __func__, driver, drv_priv);
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -3573,13 +3573,18 @@ static void handle_auth(struct hostapd_d
+ u16 auth_alg, auth_transaction, status_code;
+ u16 resp = WLAN_STATUS_SUCCESS;
+ struct sta_info *sta = NULL;
+- int res, reply_res;
++ int res, reply_res, ubus_resp;
+ u16 fc;
+ const u8 *challenge = NULL;
+ u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
+ size_t resp_ies_len = 0;
+ u16 seq_ctrl;
+ struct radius_sta rad_info;
++ struct hostapd_ubus_request req = {
++ .type = HOSTAPD_UBUS_AUTH_REQ,
++ .mgmt_frame = mgmt,
++ .ssi_signal = rssi,
++ };
+
+ if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
+ wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
+@@ -3747,6 +3752,13 @@ static void handle_auth(struct hostapd_d
+ resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ goto fail;
+ }
++ ubus_resp = hostapd_ubus_handle_event(hapd, &req);
++ if (ubus_resp) {
++ wpa_printf(MSG_DEBUG, "Station " MACSTR " rejected by ubus handler.\n",
++ MAC2STR(mgmt->sa));
++ resp = ubus_resp > 0 ? (u16) ubus_resp : WLAN_STATUS_UNSPECIFIED_FAILURE;
++ goto fail;
++ }
+ if (res == HOSTAPD_ACL_PENDING)
+ return;
+
+@@ -5488,7 +5500,7 @@ static void handle_assoc(struct hostapd_
+ int resp = WLAN_STATUS_SUCCESS;
+ u16 reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ const u8 *pos;
+- int left, i;
++ int left, i, ubus_resp;
+ struct sta_info *sta;
+ u8 *tmp = NULL;
+ #ifdef CONFIG_FILS
+@@ -5701,6 +5713,11 @@ static void handle_assoc(struct hostapd_
+ left = res;
+ }
+ #endif /* CONFIG_FILS */
++ struct hostapd_ubus_request req = {
++ .type = HOSTAPD_UBUS_ASSOC_REQ,
++ .mgmt_frame = mgmt,
++ .ssi_signal = rssi,
++ };
+
+ /* followed by SSID and Supported rates; and HT capabilities if 802.11n
+ * is used */
+@@ -5799,6 +5816,13 @@ static void handle_assoc(struct hostapd_
+ }
+ #endif /* CONFIG_FILS */
+
++ ubus_resp = hostapd_ubus_handle_event(hapd, &req);
++ if (ubus_resp) {
++ wpa_printf(MSG_DEBUG, "Station " MACSTR " assoc rejected by ubus handler.\n",
++ MAC2STR(mgmt->sa));
++ resp = ubus_resp > 0 ? (u16) ubus_resp : WLAN_STATUS_UNSPECIFIED_FAILURE;
++ goto fail;
++ }
+ fail:
+
+ /*
+@@ -5892,6 +5916,7 @@ static void handle_disassoc(struct hosta
+ wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
+ MAC2STR(mgmt->sa),
+ le_to_host16(mgmt->u.disassoc.reason_code));
++ hostapd_ubus_notify(hapd, "disassoc", mgmt->sa);
+
+ sta = ap_get_sta(hapd, mgmt->sa);
+ if (sta == NULL) {
+@@ -5961,6 +5986,8 @@ static void handle_deauth(struct hostapd
+ /* Clear the PTKSA cache entries for PASN */
+ ptksa_cache_flush(hapd->ptksa, mgmt->sa, WPA_CIPHER_NONE);
+
++ hostapd_ubus_notify(hapd, "deauth", mgmt->sa);
++
+ sta = ap_get_sta(hapd, mgmt->sa);
+ if (sta == NULL) {
+ wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -919,6 +919,12 @@ void handle_probe_req(struct hostapd_dat
+ u16 csa_offs[2];
+ size_t csa_offs_len;
+ struct radius_sta rad_info;
++ struct hostapd_ubus_request req = {
++ .type = HOSTAPD_UBUS_PROBE_REQ,
++ .mgmt_frame = mgmt,
++ .ssi_signal = ssi_signal,
++ .elems = &elems,
++ };
+
+ if (hapd->iconf->rssi_ignore_probe_request && ssi_signal &&
+ ssi_signal < hapd->iconf->rssi_ignore_probe_request)
+@@ -1105,6 +1111,12 @@ void handle_probe_req(struct hostapd_dat
+ }
+ #endif /* CONFIG_P2P */
+
++ if (hostapd_ubus_handle_event(hapd, &req)) {
++ wpa_printf(MSG_DEBUG, "Probe request for " MACSTR " rejected by ubus handler.\n",
++ MAC2STR(mgmt->sa));
++ return;
++ }
++
+ /* TODO: verify that supp_rates contains at least one matching rate
+ * with AP configuration */
+
+--- a/src/ap/drv_callbacks.c
++++ b/src/ap/drv_callbacks.c
+@@ -145,6 +145,10 @@ int hostapd_notif_assoc(struct hostapd_d
+ u16 reason = WLAN_REASON_UNSPECIFIED;
+ int status = WLAN_STATUS_SUCCESS;
+ const u8 *p2p_dev_addr = NULL;
++ struct hostapd_ubus_request req = {
++ .type = HOSTAPD_UBUS_ASSOC_REQ,
++ .addr = addr,
++ };
+
+ if (addr == NULL) {
+ /*
+@@ -237,6 +241,12 @@ int hostapd_notif_assoc(struct hostapd_d
+ goto fail;
+ }
+
++ if (hostapd_ubus_handle_event(hapd, &req)) {
++ wpa_printf(MSG_DEBUG, "Station " MACSTR " assoc rejected by ubus handler.\n",
++ MAC2STR(req.addr));
++ goto fail;
++ }
++
+ #ifdef CONFIG_P2P
+ if (elems.p2p) {
+ wpabuf_free(sta->p2p_ie);
+--- a/src/ap/sta_info.c
++++ b/src/ap/sta_info.c
+@@ -460,6 +460,7 @@ void ap_handle_timer(void *eloop_ctx, vo
+ hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
+ HOSTAPD_LEVEL_INFO, "deauthenticated due to "
+ "local deauth request");
++ hostapd_ubus_notify(hapd, "local-deauth", sta->addr);
+ ap_free_sta(hapd, sta);
+ return;
+ }
+@@ -615,6 +616,7 @@ skip_poll:
+ mlme_deauthenticate_indication(
+ hapd, sta,
+ WLAN_REASON_PREV_AUTH_NOT_VALID);
++ hostapd_ubus_notify(hapd, "inactive-deauth", sta->addr);
+ ap_free_sta(hapd, sta);
+ break;
+ }
+@@ -1298,12 +1300,25 @@ void ap_sta_set_authorized(struct hostap
+ sta->addr, authorized, dev_addr);
+
+ if (authorized) {
++ static const char * const auth_algs[] = {
++ [WLAN_AUTH_OPEN] = "open",
++ [WLAN_AUTH_SHARED_KEY] = "shared",
++ [WLAN_AUTH_FT] = "ft",
++ [WLAN_AUTH_SAE] = "sae",
++ [WLAN_AUTH_FILS_SK] = "fils-sk",
++ [WLAN_AUTH_FILS_SK_PFS] = "fils-sk-pfs",
++ [WLAN_AUTH_FILS_PK] = "fils-pk",
++ [WLAN_AUTH_PASN] = "pasn",
++ };
++ const char *auth_alg = NULL;
+ const char *keyid;
+ char keyid_buf[100];
+ char ip_addr[100];
++ char alg_buf[100];
+
+ keyid_buf[0] = '\0';
+ ip_addr[0] = '\0';
++ alg_buf[0] = '\0';
+ #ifdef CONFIG_P2P
+ if (wpa_auth_get_ip_addr(sta->wpa_sm, ip_addr_buf) == 0) {
+ os_snprintf(ip_addr, sizeof(ip_addr),
+@@ -1313,22 +1328,31 @@ void ap_sta_set_authorized(struct hostap
+ }
+ #endif /* CONFIG_P2P */
+
++ if (sta->auth_alg < ARRAY_SIZE(auth_algs))
++ auth_alg = auth_algs[sta->auth_alg];
++
++ if (auth_alg)
++ os_snprintf(alg_buf, sizeof(alg_buf),
++ " auth_alg=%s", auth_alg);
++
+ keyid = ap_sta_wpa_get_keyid(hapd, sta);
+ if (keyid) {
+ os_snprintf(keyid_buf, sizeof(keyid_buf),
+ " keyid=%s", keyid);
+ }
+
+- wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s%s",
+- buf, ip_addr, keyid_buf);
++ hostapd_ubus_notify_authorized(hapd, sta, auth_alg);
++ wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s%s%s",
++ buf, ip_addr, keyid_buf, alg_buf);
+
+ if (hapd->msg_ctx_parent &&
+ hapd->msg_ctx_parent != hapd->msg_ctx)
+ wpa_msg_no_global(hapd->msg_ctx_parent, MSG_INFO,
+- AP_STA_CONNECTED "%s%s%s",
+- buf, ip_addr, keyid_buf);
++ AP_STA_CONNECTED "%s%s%s%s",
++ buf, ip_addr, keyid_buf, alg_buf);
+ } else {
+ wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED "%s", buf);
++ hostapd_ubus_notify(hapd, "disassoc", sta->addr);
+
+ if (hapd->msg_ctx_parent &&
+ hapd->msg_ctx_parent != hapd->msg_ctx)
+--- a/src/ap/wpa_auth_glue.c
++++ b/src/ap/wpa_auth_glue.c
+@@ -268,6 +268,7 @@ static void hostapd_wpa_auth_psk_failure
+ struct hostapd_data *hapd = ctx;
+ wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POSSIBLE_PSK_MISMATCH MACSTR,
+ MAC2STR(addr));
++ hostapd_ubus_notify(hapd, "key-mismatch", addr);
+ }
+
+
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -183,6 +183,12 @@ ifdef CONFIG_EAPOL_TEST
+ CFLAGS += -Werror -DEAPOL_TEST
+ endif
+
++ifdef CONFIG_UBUS
++CFLAGS += -DUBUS_SUPPORT
++OBJS += ubus.o
++LIBS += -lubox -lubus
++endif
++
+ ifdef CONFIG_CODE_COVERAGE
+ CFLAGS += -O0 -fprofile-arcs -ftest-coverage
+ LIBS += -lgcov
+@@ -977,6 +983,9 @@ ifdef CONFIG_CTRL_IFACE_MIB
+ CFLAGS += -DCONFIG_CTRL_IFACE_MIB
+ endif
+ OBJS += ../src/ap/ctrl_iface_ap.o
++ifdef CONFIG_UBUS
++OBJS += ../src/ap/ubus.o
++endif
+ endif
+
+ CFLAGS += -DEAP_SERVER -DEAP_SERVER_IDENTITY
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -7285,6 +7285,8 @@ struct wpa_supplicant * wpa_supplicant_a
+ }
+ #endif /* CONFIG_P2P */
+
++ wpas_ubus_add_bss(wpa_s);
++
+ return wpa_s;
+ }
+
+@@ -7311,6 +7313,8 @@ int wpa_supplicant_remove_iface(struct w
+ struct wpa_supplicant *parent = wpa_s->parent;
+ #endif /* CONFIG_MESH */
+
++ wpas_ubus_free_bss(wpa_s);
++
+ /* Remove interface from the global list of interfaces */
+ prev = global->ifaces;
+ if (prev == wpa_s) {
+@@ -7614,8 +7618,12 @@ int wpa_supplicant_run(struct wpa_global
+ eloop_register_signal_terminate(wpa_supplicant_terminate, global);
+ eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
+
++ wpas_ubus_add(global);
++
+ eloop_run();
+
++ wpas_ubus_free(global);
++
+ return 0;
+ }
+
+--- a/wpa_supplicant/wpa_supplicant_i.h
++++ b/wpa_supplicant/wpa_supplicant_i.h
+@@ -20,6 +20,7 @@
+ #include "wps/wps_defs.h"
+ #include "config_ssid.h"
+ #include "wmm_ac.h"
++#include "ubus.h"
+
+ extern const char *const wpa_supplicant_version;
+ extern const char *const wpa_supplicant_license;
+@@ -323,6 +324,8 @@ struct wpa_global {
+ #endif /* CONFIG_WIFI_DISPLAY */
+
+ struct psk_list_entry *add_psk; /* From group formation */
++
++ struct ubus_object ubus_global;
+ };
+
+
+@@ -707,6 +710,7 @@ struct wpa_supplicant {
+ unsigned char own_addr[ETH_ALEN];
+ unsigned char perm_addr[ETH_ALEN];
+ char ifname[100];
++ struct wpas_ubus_bss ubus;
+ #ifdef CONFIG_MATCH_IFACE
+ int matched;
+ #endif /* CONFIG_MATCH_IFACE */
+--- a/wpa_supplicant/wps_supplicant.c
++++ b/wpa_supplicant/wps_supplicant.c
+@@ -33,6 +33,7 @@
+ #include "p2p/p2p.h"
+ #include "p2p_supplicant.h"
+ #include "wps_supplicant.h"
++#include "ubus.h"
+
+
+ #ifndef WPS_PIN_SCAN_IGNORE_SEL_REG
+@@ -391,6 +392,8 @@ static int wpa_supplicant_wps_cred(void
+ wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
+ cred->cred_attr, cred->cred_attr_len);
+
++ wpas_ubus_notify(wpa_s, cred);
++
+ if (wpa_s->conf->wps_cred_processing == 1)
+ return 0;
+
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -897,6 +897,7 @@ int main(int argc, char *argv[])
+ }
+
+ hostapd_global_ctrl_iface_init(&interfaces);
++ hostapd_ubus_add(&interfaces);
+
+ if (hostapd_global_run(&interfaces, daemonize, pid_file)) {
+ wpa_printf(MSG_ERROR, "Failed to start eloop");
+@@ -906,6 +907,7 @@ int main(int argc, char *argv[])
+ ret = 0;
+
+ out:
++ hostapd_ubus_free(&interfaces);
+ hostapd_global_ctrl_iface_deinit(&interfaces);
+ /* Deinitialize all interfaces */
+ for (i = 0; i < interfaces.count; i++) {
+--- a/wpa_supplicant/main.c
++++ b/wpa_supplicant/main.c
+@@ -204,7 +204,7 @@ int main(int argc, char *argv[])
+
+ for (;;) {
+ c = getopt(argc, argv,
+- "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuv::W");
++ "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:nNo:O:p:P:qsTtuv::W");
+ if (c < 0)
+ break;
+ switch (c) {
+@@ -272,6 +272,9 @@ int main(int argc, char *argv[])
+ params.conf_p2p_dev = optarg;
+ break;
+ #endif /* CONFIG_P2P */
++ case 'n':
++ iface_count = 0;
++ break;
+ case 'o':
+ params.override_driver = optarg;
+ break;
+--- a/src/ap/rrm.c
++++ b/src/ap/rrm.c
+@@ -89,6 +89,9 @@ static void hostapd_handle_beacon_report
+ return;
+ wpa_msg(hapd->msg_ctx, MSG_INFO, BEACON_RESP_RX MACSTR " %u %02x %s",
+ MAC2STR(addr), token, rep_mode, report);
++ if (len < sizeof(struct rrm_measurement_beacon_report))
++ return;
++ hostapd_ubus_notify_beacon_report(hapd, addr, token, rep_mode, (struct rrm_measurement_beacon_report*) pos, len);
+ }
+
+
+@@ -352,6 +355,9 @@ void hostapd_handle_radio_measurement(st
+ mgmt->u.action.u.rrm.action, MAC2STR(mgmt->sa));
+
+ switch (mgmt->u.action.u.rrm.action) {
++ case WLAN_RRM_LINK_MEASUREMENT_REPORT:
++ hostapd_ubus_handle_link_measurement(hapd, buf, len);
++ break;
+ case WLAN_RRM_RADIO_MEASUREMENT_REPORT:
+ hostapd_handle_radio_msmt_report(hapd, buf, len);
+ break;
+--- a/src/ap/vlan_init.c
++++ b/src/ap/vlan_init.c
+@@ -22,6 +22,7 @@
+ static int vlan_if_add(struct hostapd_data *hapd, struct hostapd_vlan *vlan,
+ int existsok)
+ {
++ bool vlan_exists = iface_exists(vlan->ifname);
+ int ret;
+ #ifdef CONFIG_WEP
+ int i;
+@@ -36,7 +37,7 @@ static int vlan_if_add(struct hostapd_da
+ }
+ #endif /* CONFIG_WEP */
+
+- if (!iface_exists(vlan->ifname))
++ if (!vlan_exists)
+ ret = hostapd_vlan_if_add(hapd, vlan->ifname);
+ else if (!existsok)
+ return -1;
+@@ -51,6 +52,9 @@ static int vlan_if_add(struct hostapd_da
+ if (hapd->wpa_auth)
+ ret = wpa_auth_ensure_group(hapd->wpa_auth, vlan->vlan_id);
+
++ if (!ret && !vlan_exists)
++ hostapd_ubus_add_vlan(hapd, vlan);
++
+ if (ret == 0)
+ return ret;
+
+@@ -77,6 +81,8 @@ int vlan_if_remove(struct hostapd_data *
+ "WPA deinitialization for VLAN %d failed (%d)",
+ vlan->vlan_id, ret);
+
++ hostapd_ubus_remove_vlan(hapd, vlan);
++
+ return hostapd_vlan_if_remove(hapd, vlan->ifname);
+ }
+
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1203,6 +1203,8 @@ int hostapd_dfs_pre_cac_expired(struct h
+ "freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d",
+ freq, ht_enabled, chan_offset, chan_width, cf1, cf2);
+
++ hostapd_ubus_notify_radar_detected(iface, freq, chan_width, cf1, cf2);
++
+ /* Proceed only if DFS is not offloaded to the driver */
+ if (iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD)
+ return 0;
+--- a/src/ap/airtime_policy.c
++++ b/src/ap/airtime_policy.c
+@@ -112,8 +112,14 @@ static void set_sta_weights(struct hosta
+ {
+ struct sta_info *sta;
+
+- for (sta = hapd->sta_list; sta; sta = sta->next)
+- sta_set_airtime_weight(hapd, sta, weight);
++ for (sta = hapd->sta_list; sta; sta = sta->next) {
++ unsigned int sta_weight = weight;
++
++ if (sta->dyn_airtime_weight)
++ sta_weight = (weight * sta->dyn_airtime_weight) / 256;
++
++ sta_set_airtime_weight(hapd, sta, sta_weight);
++ }
+ }
+
+
+@@ -244,7 +250,10 @@ int airtime_policy_new_sta(struct hostap
+ unsigned int weight;
+
+ if (hapd->iconf->airtime_mode == AIRTIME_MODE_STATIC) {
+- weight = get_weight_for_sta(hapd, sta->addr);
++ if (sta->dyn_airtime_weight)
++ weight = sta->dyn_airtime_weight;
++ else
++ weight = get_weight_for_sta(hapd, sta->addr);
+ if (weight)
+ return sta_set_airtime_weight(hapd, sta, weight);
+ }
+--- a/src/ap/sta_info.h
++++ b/src/ap/sta_info.h
+@@ -328,6 +328,7 @@ struct sta_info {
+ #endif /* CONFIG_TESTING_OPTIONS */
+ #ifdef CONFIG_AIRTIME_POLICY
+ unsigned int airtime_weight;
++ unsigned int dyn_airtime_weight;
+ struct os_reltime backlogged_until;
+ #endif /* CONFIG_AIRTIME_POLICY */
+
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -455,7 +455,8 @@ static void ieee802_11_rx_bss_trans_mgmt
+ MAC2STR(addr), reason, hex ? " neighbor=" : "", hex);
+ os_free(hex);
+
+- ieee802_11_send_bss_trans_mgmt_request(hapd, addr, dialog_token);
++ if (!hostapd_ubus_notify_bss_transition_query(hapd, addr, dialog_token, reason, pos, end - pos))
++ ieee802_11_send_bss_trans_mgmt_request(hapd, addr, dialog_token);
+ }
+
+
+@@ -477,7 +478,7 @@ static void ieee802_11_rx_bss_trans_mgmt
+ size_t len)
+ {
+ u8 dialog_token, status_code, bss_termination_delay;
+- const u8 *pos, *end;
++ const u8 *pos, *end, *target_bssid = NULL;
+ int enabled = hapd->conf->bss_transition;
+ struct sta_info *sta;
+
+@@ -524,6 +525,7 @@ static void ieee802_11_rx_bss_trans_mgmt
+ wpa_printf(MSG_DEBUG, "WNM: not enough room for Target BSSID field");
+ return;
+ }
++ target_bssid = pos;
+ sta->agreed_to_steer = 1;
+ eloop_cancel_timeout(ap_sta_reset_steer_flag_timer, hapd, sta);
+ eloop_register_timeout(2, 0, ap_sta_reset_steer_flag_timer,
+@@ -543,6 +545,10 @@ static void ieee802_11_rx_bss_trans_mgmt
+ MAC2STR(addr), status_code, bss_termination_delay);
+ }
+
++ hostapd_ubus_notify_bss_transition_response(hapd, sta->addr, dialog_token,
++ status_code, bss_termination_delay,
++ target_bssid, pos, end - pos);
++
+ wpa_hexdump(MSG_DEBUG, "WNM: BSS Transition Candidate List Entries",
+ pos, end - pos);
+ }
diff --git a/recipes-wifi/hostapd/files/patches-2.11/610-hostapd_cli_ujail_permission.patch b/recipes-wifi/hostapd/files/patches-2.11/610-hostapd_cli_ujail_permission.patch
new file mode 100644
index 0000000..a03fcc9
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/610-hostapd_cli_ujail_permission.patch
@@ -0,0 +1,33 @@
+--- a/src/common/wpa_ctrl.c
++++ b/src/common/wpa_ctrl.c
+@@ -135,7 +135,7 @@ try_again:
+ return NULL;
+ }
+ tries++;
+-#ifdef ANDROID
++
+ /* Set client socket file permissions so that bind() creates the client
+ * socket with these permissions and there is no need to try to change
+ * them with chmod() after bind() which would have potential issues with
+@@ -147,7 +147,7 @@ try_again:
+ * operations to allow the response to go through. Those are using the
+ * no-deference-symlinks version to avoid races. */
+ fchmod(ctrl->s, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+-#endif /* ANDROID */
++
+ if (bind(ctrl->s, (struct sockaddr *) &ctrl->local,
+ sizeof(ctrl->local)) < 0) {
+ if (errno == EADDRINUSE && tries < 2) {
+@@ -165,7 +165,11 @@ try_again:
+ return NULL;
+ }
+
+-#ifdef ANDROID
++#ifndef ANDROID
++ /* Set group even if we do not have privileges to change owner */
++ lchown(ctrl->local.sun_path, -1, 101);
++ lchown(ctrl->local.sun_path, 101, 101);
++#else
+ /* Set group even if we do not have privileges to change owner */
+ lchown(ctrl->local.sun_path, -1, AID_WIFI);
+ lchown(ctrl->local.sun_path, AID_SYSTEM, AID_WIFI);
diff --git a/recipes-wifi/hostapd/files/patches-2.11/700-wifi-reload.patch b/recipes-wifi/hostapd/files/patches-2.11/700-wifi-reload.patch
new file mode 100644
index 0000000..174127d
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/700-wifi-reload.patch
@@ -0,0 +1,220 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2416,6 +2416,8 @@ static int hostapd_config_fill(struct ho
+ bss->isolate = atoi(pos);
+ } else if (os_strcmp(buf, "ap_max_inactivity") == 0) {
+ bss->ap_max_inactivity = atoi(pos);
++ } else if (os_strcmp(buf, "config_id") == 0) {
++ bss->config_id = os_strdup(pos);
+ } else if (os_strcmp(buf, "skip_inactivity_poll") == 0) {
+ bss->skip_inactivity_poll = atoi(pos);
+ } else if (os_strcmp(buf, "country_code") == 0) {
+@@ -3121,6 +3123,8 @@ static int hostapd_config_fill(struct ho
+ }
+ } else if (os_strcmp(buf, "acs_exclude_dfs") == 0) {
+ conf->acs_exclude_dfs = atoi(pos);
++ } else if (os_strcmp(buf, "radio_config_id") == 0) {
++ conf->config_id = os_strdup(pos);
+ } else if (os_strcmp(buf, "op_class") == 0) {
+ conf->op_class = atoi(pos);
+ } else if (os_strcmp(buf, "channel") == 0) {
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -796,6 +796,7 @@ void hostapd_config_free_bss(struct host
+ os_free(conf->radius_req_attr_sqlite);
+ os_free(conf->rsn_preauth_interfaces);
+ os_free(conf->ctrl_interface);
++ os_free(conf->config_id);
+ os_free(conf->ca_cert);
+ os_free(conf->server_cert);
+ os_free(conf->server_cert2);
+@@ -995,6 +996,7 @@ void hostapd_config_free(struct hostapd_
+
+ for (i = 0; i < conf->num_bss; i++)
+ hostapd_config_free_bss(conf->bss[i]);
++ os_free(conf->config_id);
+ os_free(conf->bss);
+ os_free(conf->supported_rates);
+ os_free(conf->basic_rates);
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -285,6 +285,8 @@ struct hostapd_bss_config {
+ char vlan_bridge[IFNAMSIZ + 1];
+ char wds_bridge[IFNAMSIZ + 1];
+
++ char *config_id;
++
+ enum hostapd_logger_level logger_syslog_level, logger_stdout_level;
+
+ unsigned int logger_syslog; /* module bitfield */
+@@ -969,6 +971,7 @@ struct eht_phy_capabilities_info {
+ struct hostapd_config {
+ struct hostapd_bss_config **bss, *last_bss;
+ size_t num_bss;
++ char *config_id;
+
+ u16 beacon_int;
+ int rts_threshold;
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -224,6 +224,10 @@ static int hostapd_iface_conf_changed(st
+ {
+ size_t i;
+
++ if (newconf->config_id != oldconf->config_id)
++ if (strcmp(newconf->config_id, oldconf->config_id))
++ return 1;
++
+ if (newconf->num_bss != oldconf->num_bss)
+ return 1;
+
+@@ -237,7 +241,7 @@ static int hostapd_iface_conf_changed(st
+ }
+
+
+-int hostapd_reload_config(struct hostapd_iface *iface)
++int hostapd_reload_config(struct hostapd_iface *iface, int reconf)
+ {
+ struct hapd_interfaces *interfaces = iface->interfaces;
+ struct hostapd_data *hapd = iface->bss[0];
+@@ -260,13 +264,16 @@ int hostapd_reload_config(struct hostapd
+ if (newconf == NULL)
+ return -1;
+
+- hostapd_clear_old(iface);
+-
+ oldconf = hapd->iconf;
+ if (hostapd_iface_conf_changed(newconf, oldconf)) {
+ char *fname;
+ int res;
+
++ if (reconf)
++ return -1;
++
++ hostapd_clear_old(iface);
++
+ wpa_printf(MSG_DEBUG,
+ "Configuration changes include interface/BSS modification - force full disable+enable sequence");
+ fname = os_strdup(iface->config_fname);
+@@ -291,6 +298,24 @@ int hostapd_reload_config(struct hostapd
+ wpa_printf(MSG_ERROR,
+ "Failed to enable interface on config reload");
+ return res;
++ } else {
++ for (j = 0; j < iface->num_bss; j++) {
++ hapd = iface->bss[j];
++ if (!hapd->config_id || strcmp(hapd->config_id, newconf->bss[j]->config_id)) {
++ hostapd_flush_old_stations(iface->bss[j],
++ WLAN_REASON_PREV_AUTH_NOT_VALID);
++#ifdef CONFIG_WEP
++ hostapd_broadcast_wep_clear(iface->bss[j]);
++#endif
++
++#ifndef CONFIG_NO_RADIUS
++ /* TODO: update dynamic data based on changed configuration
++ * items (e.g., open/close sockets, etc.) */
++ radius_client_flush(iface->bss[j]->radius, 0);
++#endif /* CONFIG_NO_RADIUS */
++ wpa_printf(MSG_INFO, "bss %zu changed", j);
++ }
++ }
+ }
+ iface->conf = newconf;
+
+@@ -307,6 +332,12 @@ int hostapd_reload_config(struct hostapd
+
+ for (j = 0; j < iface->num_bss; j++) {
+ hapd = iface->bss[j];
++ if (hapd->config_id) {
++ os_free(hapd->config_id);
++ hapd->config_id = NULL;
++ }
++ if (newconf->bss[j]->config_id)
++ hapd->config_id = strdup(newconf->bss[j]->config_id);
+ hapd->iconf = newconf;
+ hapd->conf = newconf->bss[j];
+ hostapd_reload_bss(hapd);
+@@ -2420,6 +2451,10 @@ hostapd_alloc_bss_data(struct hostapd_if
+ hapd->iconf = conf;
+ hapd->conf = bss;
+ hapd->iface = hapd_iface;
++ if (bss && bss->config_id)
++ hapd->config_id = strdup(bss->config_id);
++ else
++ hapd->config_id = NULL;
+ if (conf)
+ hapd->driver = conf->driver;
+ hapd->ctrl_sock = -1;
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -47,7 +47,7 @@ struct mesh_conf;
+ struct hostapd_iface;
+
+ struct hapd_interfaces {
+- int (*reload_config)(struct hostapd_iface *iface);
++ int (*reload_config)(struct hostapd_iface *iface, int reconf);
+ struct hostapd_config * (*config_read_cb)(const char *config_fname);
+ int (*ctrl_iface_init)(struct hostapd_data *hapd);
+ void (*ctrl_iface_deinit)(struct hostapd_data *hapd);
+@@ -185,6 +185,7 @@ struct hostapd_data {
+ struct hostapd_config *iconf;
+ struct hostapd_bss_config *conf;
+ struct hostapd_ubus_bss ubus;
++ char *config_id;
+ int interface_added; /* virtual interface added for this BSS */
+ unsigned int started:1;
+ unsigned int disabled:1;
+@@ -667,7 +668,7 @@ struct hostapd_iface {
+ int hostapd_for_each_interface(struct hapd_interfaces *interfaces,
+ int (*cb)(struct hostapd_iface *iface,
+ void *ctx), void *ctx);
+-int hostapd_reload_config(struct hostapd_iface *iface);
++int hostapd_reload_config(struct hostapd_iface *iface, int reconf);
+ void hostapd_reconfig_encryption(struct hostapd_data *hapd);
+ struct hostapd_data *
+ hostapd_alloc_bss_data(struct hostapd_iface *hapd_iface,
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -4852,6 +4852,9 @@ static int wpa_driver_nl80211_set_ap(voi
+ if (ret) {
+ wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
+ ret, strerror(-ret));
++ if (!bss->beacon_set)
++ ret = 0;
++ bss->beacon_set = 0;
+ } else {
+ bss->beacon_set = 1;
+ nl80211_set_bss(bss, params->cts_protect, params->preamble,
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -186,7 +186,7 @@ static int hostapd_ctrl_iface_update(str
+ iface->interfaces->config_read_cb = hostapd_ctrl_iface_config_read;
+ reload_opts = txt;
+
+- hostapd_reload_config(iface);
++ hostapd_reload_config(iface, 0);
+
+ iface->interfaces->config_read_cb = config_read_cb;
+ }
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -317,7 +317,7 @@ static void handle_term(int sig, void *s
+
+ static int handle_reload_iface(struct hostapd_iface *iface, void *ctx)
+ {
+- if (hostapd_reload_config(iface) < 0) {
++ if (hostapd_reload_config(iface, 0) < 0) {
+ wpa_printf(MSG_WARNING, "Failed to read new configuration "
+ "file - continuing with old.");
+ }
+--- a/src/ap/wps_hostapd.c
++++ b/src/ap/wps_hostapd.c
+@@ -315,7 +315,7 @@ static void wps_reload_config(void *eloo
+
+ wpa_printf(MSG_DEBUG, "WPS: Reload configuration data");
+ if (iface->interfaces == NULL ||
+- iface->interfaces->reload_config(iface) < 0) {
++ iface->interfaces->reload_config(iface, 1) < 0) {
+ wpa_printf(MSG_WARNING, "WPS: Failed to reload the updated "
+ "configuration");
+ }
diff --git a/recipes-wifi/hostapd/files/patches-2.11/710-vlan_no_bridge.patch b/recipes-wifi/hostapd/files/patches-2.11/710-vlan_no_bridge.patch
new file mode 100644
index 0000000..b06ef8f
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/710-vlan_no_bridge.patch
@@ -0,0 +1,41 @@
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -121,6 +121,7 @@ struct hostapd_ssid {
+ #define DYNAMIC_VLAN_OPTIONAL 1
+ #define DYNAMIC_VLAN_REQUIRED 2
+ int dynamic_vlan;
++ int vlan_no_bridge;
+ #define DYNAMIC_VLAN_NAMING_WITHOUT_DEVICE 0
+ #define DYNAMIC_VLAN_NAMING_WITH_DEVICE 1
+ #define DYNAMIC_VLAN_NAMING_END 2
+--- a/src/ap/vlan_full.c
++++ b/src/ap/vlan_full.c
+@@ -475,6 +475,9 @@ void vlan_newlink(const char *ifname, st
+ if (!vlan)
+ return;
+
++ if (hapd->conf->ssid.vlan_no_bridge)
++ goto out;
++
+ vlan->configured = 1;
+
+ notempty = vlan->vlan_desc.notempty;
+@@ -506,6 +509,7 @@ void vlan_newlink(const char *ifname, st
+ ifname, br_name, tagged[i], hapd);
+ }
+
++out:
+ ifconfig_up(ifname);
+ }
+
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3346,6 +3346,8 @@ static int hostapd_config_fill(struct ho
+ #ifndef CONFIG_NO_VLAN
+ } else if (os_strcmp(buf, "dynamic_vlan") == 0) {
+ bss->ssid.dynamic_vlan = atoi(pos);
++ } else if (os_strcmp(buf, "vlan_no_bridge") == 0) {
++ bss->ssid.vlan_no_bridge = atoi(pos);
+ } else if (os_strcmp(buf, "per_sta_vif") == 0) {
+ bss->ssid.per_sta_vif = atoi(pos);
+ } else if (os_strcmp(buf, "vlan_file") == 0) {
diff --git a/recipes-wifi/hostapd/files/patches-2.11/711-wds_bridge_force.patch b/recipes-wifi/hostapd/files/patches-2.11/711-wds_bridge_force.patch
new file mode 100644
index 0000000..169807c
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/711-wds_bridge_force.patch
@@ -0,0 +1,22 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2316,6 +2316,8 @@ static int hostapd_config_fill(struct ho
+ sizeof(conf->bss[0]->iface));
+ } else if (os_strcmp(buf, "bridge") == 0) {
+ os_strlcpy(bss->bridge, pos, sizeof(bss->bridge));
++ if (!bss->wds_bridge[0])
++ os_strlcpy(bss->wds_bridge, pos, sizeof(bss->wds_bridge));
+ } else if (os_strcmp(buf, "vlan_bridge") == 0) {
+ os_strlcpy(bss->vlan_bridge, pos, sizeof(bss->vlan_bridge));
+ } else if (os_strcmp(buf, "wds_bridge") == 0) {
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -340,8 +340,6 @@ int hostapd_set_wds_sta(struct hostapd_d
+ return -1;
+ if (hapd->conf->wds_bridge[0])
+ bridge = hapd->conf->wds_bridge;
+- else if (hapd->conf->bridge[0])
+- bridge = hapd->conf->bridge;
+ return hapd->driver->set_wds_sta(hapd->drv_priv, addr, aid, val,
+ bridge, ifname_wds);
+ }
diff --git a/recipes-wifi/hostapd/files/patches-2.11/720-iface_max_num_sta.patch b/recipes-wifi/hostapd/files/patches-2.11/720-iface_max_num_sta.patch
new file mode 100644
index 0000000..ed76d22
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/720-iface_max_num_sta.patch
@@ -0,0 +1,82 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2841,6 +2841,14 @@ static int hostapd_config_fill(struct ho
+ line, bss->max_num_sta, MAX_STA_COUNT);
+ return 1;
+ }
++ } else if (os_strcmp(buf, "iface_max_num_sta") == 0) {
++ conf->max_num_sta = atoi(pos);
++ if (conf->max_num_sta < 0 ||
++ conf->max_num_sta > MAX_STA_COUNT) {
++ wpa_printf(MSG_ERROR, "Line %d: Invalid max_num_sta=%d; allowed range 0..%d",
++ line, conf->max_num_sta, MAX_STA_COUNT);
++ return 1;
++ }
+ } else if (os_strcmp(buf, "wpa") == 0) {
+ bss->wpa = atoi(pos);
+ } else if (os_strcmp(buf, "extended_key_id") == 0) {
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -711,6 +711,7 @@ void hostapd_cleanup_cs_params(struct ho
+ void hostapd_periodic_iface(struct hostapd_iface *iface);
+ int hostapd_owe_trans_get_info(struct hostapd_data *hapd);
+ void hostapd_ocv_check_csa_sa_query(void *eloop_ctx, void *timeout_ctx);
++int hostapd_check_max_sta(struct hostapd_data *hapd);
+
+ void hostapd_switch_color(struct hostapd_data *hapd, u64 bitmap);
+ void hostapd_cleanup_cca_params(struct hostapd_data *hapd);
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -241,6 +241,30 @@ static int hostapd_iface_conf_changed(st
+ }
+
+
++static inline int hostapd_iface_num_sta(struct hostapd_iface *iface)
++{
++ int num_sta = 0;
++ int i;
++
++ for (i = 0; i < iface->num_bss; i++)
++ num_sta += iface->bss[i]->num_sta;
++
++ return num_sta;
++}
++
++
++int hostapd_check_max_sta(struct hostapd_data *hapd)
++{
++ if (hapd->num_sta >= hapd->conf->max_num_sta)
++ return 1;
++
++ if (hapd->iconf->max_num_sta &&
++ hostapd_iface_num_sta(hapd->iface) >= hapd->iconf->max_num_sta)
++ return 1;
++
++ return 0;
++}
++
+ int hostapd_reload_config(struct hostapd_iface *iface, int reconf)
+ {
+ struct hapd_interfaces *interfaces = iface->interfaces;
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1135,7 +1135,7 @@ void handle_probe_req(struct hostapd_dat
+ if (hapd->conf->no_probe_resp_if_max_sta &&
+ is_multicast_ether_addr(mgmt->da) &&
+ is_multicast_ether_addr(mgmt->bssid) &&
+- hapd->num_sta >= hapd->conf->max_num_sta &&
++ hostapd_check_max_sta(hapd) &&
+ !ap_get_sta(hapd, mgmt->sa)) {
+ wpa_printf(MSG_MSGDUMP, "%s: Ignore Probe Request from " MACSTR
+ " since no room for additional STA",
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1010,6 +1010,8 @@ struct hostapd_config {
+ unsigned int track_sta_max_num;
+ unsigned int track_sta_max_age;
+
++ int max_num_sta;
++
+ char country[3]; /* first two octets: country code as described in
+ * ISO/IEC 3166-1. Third octet:
+ * ' ' (ascii 32): all environments
diff --git a/recipes-wifi/hostapd/files/patches-2.11/730-ft_iface.patch b/recipes-wifi/hostapd/files/patches-2.11/730-ft_iface.patch
new file mode 100644
index 0000000..d9a4f15
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/730-ft_iface.patch
@@ -0,0 +1,38 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3000,6 +3000,8 @@ static int hostapd_config_fill(struct ho
+ wpa_printf(MSG_INFO,
+ "Line %d: Obsolete peerkey parameter ignored", line);
+ #ifdef CONFIG_IEEE80211R_AP
++ } else if (os_strcmp(buf, "ft_iface") == 0) {
++ os_strlcpy(bss->ft_iface, pos, sizeof(bss->ft_iface));
+ } else if (os_strcmp(buf, "mobility_domain") == 0) {
+ if (os_strlen(pos) != 2 * MOBILITY_DOMAIN_ID_LEN ||
+ hexstr2bin(pos, bss->mobility_domain,
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -283,6 +283,7 @@ struct airtime_sta_weight {
+ struct hostapd_bss_config {
+ char iface[IFNAMSIZ + 1];
+ char bridge[IFNAMSIZ + 1];
++ char ft_iface[IFNAMSIZ + 1];
+ char vlan_bridge[IFNAMSIZ + 1];
+ char wds_bridge[IFNAMSIZ + 1];
+
+--- a/src/ap/wpa_auth_glue.c
++++ b/src/ap/wpa_auth_glue.c
+@@ -1595,8 +1595,12 @@ int hostapd_setup_wpa(struct hostapd_dat
+ wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt)) {
+ const char *ft_iface;
+
+- ft_iface = hapd->conf->bridge[0] ? hapd->conf->bridge :
+- hapd->conf->iface;
++ if (hapd->conf->ft_iface[0])
++ ft_iface = hapd->conf->ft_iface;
++ else if (hapd->conf->bridge[0])
++ ft_iface = hapd->conf->bridge;
++ else
++ ft_iface = hapd->conf->iface;
+ hapd->l2 = l2_packet_init(ft_iface, NULL, ETH_P_RRB,
+ hostapd_rrb_receive, hapd, 1);
+ if (!hapd->l2) {
diff --git a/recipes-wifi/hostapd/files/patches-2.11/740-snoop_iface.patch b/recipes-wifi/hostapd/files/patches-2.11/740-snoop_iface.patch
new file mode 100644
index 0000000..608f15a
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/740-snoop_iface.patch
@@ -0,0 +1,66 @@
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -284,6 +284,7 @@ struct hostapd_bss_config {
+ char iface[IFNAMSIZ + 1];
+ char bridge[IFNAMSIZ + 1];
+ char ft_iface[IFNAMSIZ + 1];
++ char snoop_iface[IFNAMSIZ + 1];
+ char vlan_bridge[IFNAMSIZ + 1];
+ char wds_bridge[IFNAMSIZ + 1];
+
+--- a/src/ap/x_snoop.c
++++ b/src/ap/x_snoop.c
+@@ -33,14 +33,16 @@ int x_snoop_init(struct hostapd_data *ha
+
+ hapd->x_snoop_initialized = true;
+
+- if (hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_HAIRPIN_MODE,
++ if (!conf->snoop_iface[0] &&
++ hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_HAIRPIN_MODE,
+ 1)) {
+ wpa_printf(MSG_DEBUG,
+ "x_snoop: Failed to enable hairpin_mode on the bridge port");
+ return -1;
+ }
+
+- if (hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_PROXYARP, 1)) {
++ if (!conf->snoop_iface[0] &&
++ hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_PROXYARP, 1)) {
+ wpa_printf(MSG_DEBUG,
+ "x_snoop: Failed to enable proxyarp on the bridge port");
+ return -1;
+@@ -54,7 +56,8 @@ int x_snoop_init(struct hostapd_data *ha
+ }
+
+ #ifdef CONFIG_IPV6
+- if (hostapd_drv_br_set_net_param(hapd, DRV_BR_MULTICAST_SNOOPING, 1)) {
++ if (!conf->snoop_iface[0] &&
++ hostapd_drv_br_set_net_param(hapd, DRV_BR_MULTICAST_SNOOPING, 1)) {
+ wpa_printf(MSG_DEBUG,
+ "x_snoop: Failed to enable multicast snooping on the bridge");
+ return -1;
+@@ -73,8 +76,12 @@ x_snoop_get_l2_packet(struct hostapd_dat
+ {
+ struct hostapd_bss_config *conf = hapd->conf;
+ struct l2_packet_data *l2;
++ const char *ifname = conf->bridge;
+
+- l2 = l2_packet_init(conf->bridge, NULL, ETH_P_ALL, handler, hapd, 1);
++ if (conf->snoop_iface[0])
++ ifname = conf->snoop_iface;
++
++ l2 = l2_packet_init(ifname, NULL, ETH_P_ALL, handler, hapd, 1);
+ if (l2 == NULL) {
+ wpa_printf(MSG_DEBUG,
+ "x_snoop: Failed to initialize L2 packet processing %s",
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2318,6 +2318,8 @@ static int hostapd_config_fill(struct ho
+ os_strlcpy(bss->bridge, pos, sizeof(bss->bridge));
+ if (!bss->wds_bridge[0])
+ os_strlcpy(bss->wds_bridge, pos, sizeof(bss->wds_bridge));
++ } else if (os_strcmp(buf, "snoop_iface") == 0) {
++ os_strlcpy(bss->snoop_iface, pos, sizeof(bss->snoop_iface));
+ } else if (os_strcmp(buf, "vlan_bridge") == 0) {
+ os_strlcpy(bss->vlan_bridge, pos, sizeof(bss->vlan_bridge));
+ } else if (os_strcmp(buf, "wds_bridge") == 0) {
diff --git a/recipes-wifi/hostapd/files/patches-2.11/750-qos_map_set_without_interworking.patch b/recipes-wifi/hostapd/files/patches-2.11/750-qos_map_set_without_interworking.patch
new file mode 100644
index 0000000..479d561
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/750-qos_map_set_without_interworking.patch
@@ -0,0 +1,97 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -1602,6 +1602,8 @@ static int parse_anqp_elem(struct hostap
+ return 0;
+ }
+
++#endif /* CONFIG_INTERWORKING */
++
+
+ static int parse_qos_map_set(struct hostapd_bss_config *bss,
+ char *buf, int line)
+@@ -1643,8 +1645,6 @@ static int parse_qos_map_set(struct host
+ return 0;
+ }
+
+-#endif /* CONFIG_INTERWORKING */
+-
+
+ #ifdef CONFIG_HS20
+ static int hs20_parse_conn_capab(struct hostapd_bss_config *bss, char *buf,
+@@ -4046,10 +4046,10 @@ static int hostapd_config_fill(struct ho
+ bss->gas_frag_limit = val;
+ } else if (os_strcmp(buf, "gas_comeback_delay") == 0) {
+ bss->gas_comeback_delay = atoi(pos);
++#endif /* CONFIG_INTERWORKING */
+ } else if (os_strcmp(buf, "qos_map_set") == 0) {
+ if (parse_qos_map_set(bss, pos, line) < 0)
+ return 1;
+-#endif /* CONFIG_INTERWORKING */
+ #ifdef CONFIG_RADIUS_TEST
+ } else if (os_strcmp(buf, "dump_msk_file") == 0) {
+ os_free(bss->dump_msk_file);
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -1424,6 +1424,7 @@ static int hostapd_setup_bss(struct host
+ wpa_printf(MSG_ERROR, "GAS server initialization failed");
+ return -1;
+ }
++#endif /* CONFIG_INTERWORKING */
+
+ if (conf->qos_map_set_len &&
+ hostapd_drv_set_qos_map(hapd, conf->qos_map_set,
+@@ -1431,7 +1432,6 @@ static int hostapd_setup_bss(struct host
+ wpa_printf(MSG_ERROR, "Failed to initialize QoS Map");
+ return -1;
+ }
+-#endif /* CONFIG_INTERWORKING */
+
+ if (conf->bss_load_update_period && bss_load_update_init(hapd)) {
+ wpa_printf(MSG_ERROR, "BSS Load initialization failed");
+--- a/wpa_supplicant/events.c
++++ b/wpa_supplicant/events.c
+@@ -2586,8 +2586,6 @@ void wnm_bss_keep_alive_deinit(struct wp
+ }
+
+
+-#ifdef CONFIG_INTERWORKING
+-
+ static int wpas_qos_map_set(struct wpa_supplicant *wpa_s, const u8 *qos_map,
+ size_t len)
+ {
+@@ -2620,8 +2618,6 @@ static void interworking_process_assoc_r
+ }
+ }
+
+-#endif /* CONFIG_INTERWORKING */
+-
+
+ static void multi_ap_process_assoc_resp(struct wpa_supplicant *wpa_s,
+ const u8 *ies, size_t ies_len)
+@@ -2954,10 +2950,8 @@ static int wpa_supplicant_event_associnf
+ wnm_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
+ data->assoc_info.resp_ies_len);
+ #endif /* CONFIG_WNM */
+-#ifdef CONFIG_INTERWORKING
+ interworking_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
+ data->assoc_info.resp_ies_len);
+-#endif /* CONFIG_INTERWORKING */
+ if (wpa_s->hw_capab == CAPAB_VHT &&
+ get_ie(data->assoc_info.resp_ies,
+ data->assoc_info.resp_ies_len, WLAN_EID_VHT_CAP))
+--- a/src/ap/ieee802_11_shared.c
++++ b/src/ap/ieee802_11_shared.c
+@@ -1100,13 +1100,11 @@ u8 * hostapd_eid_rsnxe(struct hostapd_da
+ u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
+ const u8 *ext_capab_ie, size_t ext_capab_ie_len)
+ {
+-#ifdef CONFIG_INTERWORKING
+ /* check for QoS Map support */
+ if (ext_capab_ie_len >= 5) {
+ if (ext_capab_ie[4] & 0x01)
+ sta->qos_map_enabled = 1;
+ }
+-#endif /* CONFIG_INTERWORKING */
+
+ if (ext_capab_ie_len > 0) {
+ sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
diff --git a/recipes-wifi/hostapd/files/patches-2.11/751-qos_map_ignore_when_unsupported.patch b/recipes-wifi/hostapd/files/patches-2.11/751-qos_map_ignore_when_unsupported.patch
new file mode 100644
index 0000000..d90a275
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/751-qos_map_ignore_when_unsupported.patch
@@ -0,0 +1,12 @@
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -864,7 +864,8 @@ int hostapd_start_dfs_cac(struct hostapd
+ int hostapd_drv_set_qos_map(struct hostapd_data *hapd,
+ const u8 *qos_map_set, u8 qos_map_set_len)
+ {
+- if (!hapd->driver || !hapd->driver->set_qos_map || !hapd->drv_priv)
++ if (!hapd->driver || !hapd->driver->set_qos_map || !hapd->drv_priv ||
++ !(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_QOS_MAPPING))
+ return 0;
+ return hapd->driver->set_qos_map(hapd->drv_priv, qos_map_set,
+ qos_map_set_len);
diff --git a/recipes-wifi/hostapd/files/patches-2.11/800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch b/recipes-wifi/hostapd/files/patches-2.11/800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch
new file mode 100644
index 0000000..1d9e956
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch
@@ -0,0 +1,58 @@
+From 37528a5205cb0b9e2238b7d97fb2ff5457448f1c Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Thu, 8 Sep 2022 01:45:41 +0200
+Subject: [PATCH] acs: don't select indoor channel on outdoor operation
+
+Don't select channels designated for exclusive-indoor use when the
+country3 element is set on outdoor operation.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ src/ap/acs.c | 9 +++++++++
+ src/ap/dfs.c | 3 +++
+ 2 files changed, 12 insertions(+)
+
+--- a/src/ap/acs.c
++++ b/src/ap/acs.c
+@@ -552,6 +552,9 @@ static void acs_survey_mode_interference
+ if (chan->max_tx_power < iface->conf->min_tx_power)
+ continue;
+
++ if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
++ continue;
++
+ wpa_printf(MSG_DEBUG, "ACS: Survey analysis for channel %d (%d MHz)",
+ chan->chan, chan->freq);
+
+@@ -686,6 +689,9 @@ acs_find_ideal_chan_mode(struct hostapd_
+ if (chan->max_tx_power < iface->conf->min_tx_power)
+ continue;
+
++ if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
++ continue;
++
+ if (!chan_bw_allowed(chan, bw, 1, 1)) {
+ wpa_printf(MSG_DEBUG,
+ "ACS: Channel %d: BW %u is not supported",
+@@ -1067,6 +1073,9 @@ static int * acs_request_scan_add_freqs(
+ if (chan->max_tx_power < iface->conf->min_tx_power)
+ continue;
+
++ if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
++ continue;
++
+ *freq++ = chan->freq;
+ }
+
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -282,6 +282,9 @@ static int dfs_find_channel(struct hosta
+ if (chan->max_tx_power < iface->conf->min_tx_power)
+ continue;
+
++ if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
++ continue;
++
+ if (ret_chan && idx == channel_idx) {
+ wpa_printf(MSG_DEBUG, "Selected channel %d (%d)",
+ chan->freq, chan->chan);
diff --git a/recipes-wifi/hostapd/files/patches-2.11/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch b/recipes-wifi/hostapd/files/patches-2.11/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
new file mode 100644
index 0000000..e78a4ef
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
@@ -0,0 +1,33 @@
+From f0e9f5aab52b3eab85d28338cc996972ced4c39c Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Tue, 17 May 2022 23:07:59 +0200
+Subject: [PATCH] ctrl: make WNM_AP functions dependant on CONFIG_AP
+
+This fixes linking errors found when compiling wpa_supplicant with
+CONFIG_WNM_AP enabled but CONFIG_AP disabled.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ wpa_supplicant/ctrl_iface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/wpa_supplicant/ctrl_iface.c
++++ b/wpa_supplicant/ctrl_iface.c
+@@ -12241,7 +12241,7 @@ char * wpa_supplicant_ctrl_iface_process
+ if (wpas_ctrl_iface_coloc_intf_report(wpa_s, buf + 18))
+ reply_len = -1;
+ #endif /* CONFIG_WNM */
+-#ifdef CONFIG_WNM_AP
++#if defined(CONFIG_AP) && defined(CONFIG_WNM_AP)
+ } else if (os_strncmp(buf, "DISASSOC_IMMINENT ", 18) == 0) {
+ if (ap_ctrl_iface_disassoc_imminent(wpa_s, buf + 18))
+ reply_len = -1;
+@@ -12251,7 +12251,7 @@ char * wpa_supplicant_ctrl_iface_process
+ } else if (os_strncmp(buf, "BSS_TM_REQ ", 11) == 0) {
+ if (ap_ctrl_iface_bss_tm_req(wpa_s, buf + 11))
+ reply_len = -1;
+-#endif /* CONFIG_WNM_AP */
++#endif /* CONFIG_AP && CONFIG_WNM_AP */
+ } else if (os_strcmp(buf, "FLUSH") == 0) {
+ wpa_supplicant_ctrl_iface_flush(wpa_s);
+ } else if (os_strncmp(buf, "RADIO_WORK ", 11) == 0) {
diff --git a/recipes-wifi/hostapd/files/patches-2.11/992-openssl-include-rsa.patch b/recipes-wifi/hostapd/files/patches-2.11/992-openssl-include-rsa.patch
new file mode 100644
index 0000000..581ae9f
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/992-openssl-include-rsa.patch
@@ -0,0 +1,32 @@
+From f374d52079111a4340acb6df835f45ac6b5f3f60 Mon Sep 17 00:00:00 2001
+From: Andre Heider <a.heider@gmail.com>
+Date: Wed, 22 Jun 2022 14:13:55 +0200
+Subject: OpenSSL: Include rsa.h for all OpenSSL versions
+
+This fixes the build with OpenSSL 1.1.1:
+../src/crypto/crypto_openssl.c: In function 'crypto_rsa_oaep_sha256_decrypt':
+../src/crypto/crypto_openssl.c:4404:49: error: 'RSA_PKCS1_OAEP_PADDING' undeclared (first use in this function)
+
+Signed-off-by: Andre Heider <a.heider@gmail.com>
+---
+ src/crypto/crypto_openssl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/crypto/crypto_openssl.c
++++ b/src/crypto/crypto_openssl.c
+@@ -16,6 +16,7 @@
+ #include <openssl/dh.h>
+ #include <openssl/hmac.h>
+ #include <openssl/rand.h>
++#include <openssl/rsa.h>
+ #include <openssl/pem.h>
+ #ifdef CONFIG_ECC
+ #include <openssl/ec.h>
+@@ -25,7 +26,6 @@
+ #include <openssl/provider.h>
+ #include <openssl/core_names.h>
+ #include <openssl/param_build.h>
+-#include <openssl/rsa.h>
+ #include <openssl/encoder.h>
+ #include <openssl/decoder.h>
+ #else /* OpenSSL version >= 3.0 */
diff --git a/recipes-wifi/hostapd/files/patches-2.11/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch b/recipes-wifi/hostapd/files/patches-2.11/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
new file mode 100644
index 0000000..28af8ef
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
@@ -0,0 +1,475 @@
+From af1bd5256cc764fb222f9809996851ff3d879699 Mon Sep 17 00:00:00 2001
+From: "howard.hsu" <howard-yh.hsu@mediatek.com>
+Date: Wed, 19 Jan 2022 19:18:07 +0800
+Subject: [PATCH 99900/99909] hostapd: mtk: Add neighbor report and BSS
+ Termination for MBO certification
+
+1. Add hostapd_neighbor_count() and hostapd_neighbor_insert_buffer ()
+The first function can count the number of neighbor report in neighbore report
+database. The second can iterate neighbor report database to build up neighbor
+report data.
+
+2. Support including neighbor report elements in ANQP response
+3. Support including neignbor report elements in BTM response
+4. Support configuring BSS Termination TSF by using hostapd_cli command
+5. Disable interface if BSS Termination TSF is set
+6. Add set_send_disassoc_frame_timer() to send disassociate frame
+Function set_disassoc_timer() may fail if key was deleted first. This new
+function will not ask to delete key as set_disassoc_timer() did.
+7. Support including neighbor report elements in BTM request
+8. Add hostapd_neighbor_set_own_report_pref()
+9. Add hostapd_neighbor_set_pref_by_non_pref_chan()
+---
+ hostapd/ctrl_iface.c | 5 ++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 1 +
+ src/ap/ctrl_iface_ap.c | 19 ++++++-
+ src/ap/gas_serv.c | 29 ++++++++++
+ src/ap/gas_serv.h | 2 +
+ src/ap/neighbor_db.c | 119 +++++++++++++++++++++++++++++++++++++++++
+ src/ap/neighbor_db.h | 9 ++++
+ src/ap/wnm_ap.c | 72 +++++++++++++++++++++++--
+ 9 files changed, 252 insertions(+), 5 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index a258492..c2a2822 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1338,6 +1338,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
+ #endif /* CONFIG_DPP */
+ } else if (os_strcasecmp(cmd, "setband") == 0) {
+ ret = hostapd_ctrl_iface_set_band(hapd, value);
++ } else if (os_strcasecmp(cmd, "bss_termination_tsf") == 0) {
++ int termination_sec = atoi(value);
++ hapd->conf->bss_termination_tsf = termination_sec;
++ wpa_printf(MSG_DEBUG, "BSS Termination TSF: value = %d",
++ termination_sec);
+ } else {
+ ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
+ if (ret)
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index d7a0c7c..4a20eb4 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
+ /* comeback after 10 TUs */
+ bss->pasn_comeback_after = 10;
+ #endif /* CONFIG_PASN */
++ bss->bss_termination_tsf = 0;
+ }
+
+
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index ed3bec7..3f68e76 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -557,6 +557,7 @@ struct hostapd_bss_config {
+ int wnm_sleep_mode;
+ int wnm_sleep_mode_no_keys;
+ int bss_transition;
++ unsigned int bss_termination_tsf;
+
+ /* IEEE 802.11u - Interworking */
+ int interworking;
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index 96209ce..18bae5c 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1203,6 +1203,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ wpa_printf(MSG_DEBUG, "Invalid bss_term data");
+ return -1;
+ }
++ if (hapd->conf->bss_termination_tsf) {
++ WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
++ }
++
+ end++;
+ WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
+ }
+@@ -1229,14 +1233,25 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
+ }
+
+- if (os_strstr(cmd, " pref=1"))
++ if (os_strstr(cmd, " pref=1")) {
+ req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++ if (nei_len == 0) {
++ // Add neigibor report from neighbor report db to nei_rep buffer
++ nei_len = hostapd_neighbor_insert_buffer (hapd, nei_rep, 1000);
++ }
++ }
+ if (os_strstr(cmd, " abridged=1"))
+ req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
+- if (os_strstr(cmd, " disassoc_imminent=1"))
++ if (os_strstr(cmd, " disassoc_imminent=1")) {
+ req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
++ /* Set own BSS neighbor report preference value as 0 */
++ hostapd_neighbor_set_own_report_pref(hapd, nei_rep, nei_len, 0);
++ }
++
+
+ #ifdef CONFIG_MBO
++ hostapd_neighbor_set_pref_by_non_pref_chan(hapd, sta, nei_rep, nei_len);
++
+ pos = os_strstr(cmd, "mbo=");
+ if (pos) {
+ unsigned int mbo_reason, cell_pref, reassoc_delay;
+diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
+index 90f1577..5845ff8 100644
+--- a/src/ap/gas_serv.c
++++ b/src/ap/gas_serv.c
+@@ -19,6 +19,7 @@
+ #include "dpp_hostapd.h"
+ #include "sta_info.h"
+ #include "gas_serv.h"
++#include "neighbor_db.h"
+
+
+ #ifdef CONFIG_DPP
+@@ -369,6 +370,24 @@ static void anqp_add_network_auth_type(struct hostapd_data *hapd,
+ }
+ }
+
++static void anqp_add_neighbor_report(struct hostapd_data *hapd,
++ struct wpabuf *buf)
++{
++ struct hostapd_neighbor_entry *nr;
++ u8 *len_pos = gas_anqp_add_element(buf, ANQP_NEIGHBOR_REPORT);
++ if (dl_list_empty(&hapd->nr_db)) {
++ wpabuf_put_le16(buf, 0);
++ }
++ else {
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry, list ) {
++ wpabuf_put_u8(buf, WLAN_EID_NEIGHBOR_REPORT);
++ wpabuf_put_u8(buf, wpabuf_len(nr->nr));
++ wpabuf_put_buf(buf, nr->nr);
++ }
++ }
++ gas_anqp_set_element_len(buf, len_pos);
++}
++
+
+ static void anqp_add_roaming_consortium(struct hostapd_data *hapd,
+ struct wpabuf *buf)
+@@ -986,6 +1005,9 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ len += 1000;
+ if (request & ANQP_REQ_ICON_REQUEST)
+ len += 65536;
++ if (request & ANQP_REQ_NEIGHBOR_REPORT) {
++ len += (40 * hostapd_neighbor_count(hapd));
++ }
+ #ifdef CONFIG_FILS
+ if (request & ANQP_FILS_REALM_INFO)
+ len += 2 * dl_list_len(&hapd->conf->fils_realms);
+@@ -1028,6 +1050,8 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ anqp_add_elem(hapd, buf, ANQP_TDLS_CAPABILITY);
+ if (request & ANQP_REQ_EMERGENCY_NAI)
+ anqp_add_elem(hapd, buf, ANQP_EMERGENCY_NAI);
++ if (request & ANQP_REQ_NEIGHBOR_REPORT)
++ anqp_add_neighbor_report(hapd, buf);
+
+ for (i = 0; i < num_extra_req; i++) {
+ #ifdef CONFIG_FILS
+@@ -1172,6 +1196,11 @@ static void rx_anqp_query_list_id(struct hostapd_data *hapd, u16 info_id,
+ "Emergency NAI",
+ get_anqp_elem(hapd, info_id) != NULL, qi);
+ break;
++ case ANQP_NEIGHBOR_REPORT:
++ set_anqp_req(ANQP_REQ_NEIGHBOR_REPORT,
++ "Neighbor Report",
++ get_anqp_elem(hapd, info_id) != NULL, qi);
++ break;
+ default:
+ #ifdef CONFIG_FILS
+ if (info_id == ANQP_FILS_REALM_INFO &&
+diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
+index 1528af4..d0241f2 100644
+--- a/src/ap/gas_serv.h
++++ b/src/ap/gas_serv.h
+@@ -40,6 +40,8 @@
+ (1 << (ANQP_TDLS_CAPABILITY - ANQP_QUERY_LIST))
+ #define ANQP_REQ_EMERGENCY_NAI \
+ (1 << (ANQP_EMERGENCY_NAI - ANQP_QUERY_LIST))
++#define ANQP_REQ_NEIGHBOR_REPORT \
++ (1 << (ANQP_NEIGHBOR_REPORT - ANQP_QUERY_LIST))
+ /*
+ * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
+ * optimized bitmap.
+diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
+index 52f25eb..9254d09 100644
+--- a/src/ap/neighbor_db.c
++++ b/src/ap/neighbor_db.c
+@@ -89,6 +89,38 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
+ }
+
+
++int hostapd_neighbor_count(struct hostapd_data *hapd)
++{
++ struct hostapd_neighbor_entry *nr;
++ int count = 0;
++
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ count++;
++ }
++ return count;
++}
++
++
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++ size_t buflen)
++{
++ struct hostapd_neighbor_entry *nr;
++ char *pos = buf;
++
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ /* For neighbor report IE, we only need bssid and nr*/
++ *pos++ = WLAN_EID_NEIGHBOR_REPORT;
++ *pos++ = wpabuf_len(nr->nr);
++ os_memcpy(pos, wpabuf_head(nr->nr), wpabuf_len(nr->nr));
++ pos += wpabuf_len(nr->nr);
++ }
++
++ return pos - buf;
++}
++
++
+ static void hostapd_neighbor_clear_entry(struct hostapd_neighbor_entry *nr)
+ {
+ wpabuf_free(nr->nr);
+@@ -325,3 +357,90 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
+ wpabuf_free(nr);
+ #endif /* NEED_AP_MLME */
+ }
++
++
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++ size_t buflen, const int pref)
++{
++ struct hostapd_neighbor_entry *nr;
++ char *pos, *next_nr;
++
++ pos = nei_buf;
++ next_nr = nei_buf;
++
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ pos = next_nr;
++ next_nr = pos + 2 + wpabuf_len(nr->nr);
++ /* Shift 2 bytes for Element ID and Neighbor report length */
++ pos = pos + 2;
++ if(os_memcmp(pos, hapd->own_addr, ETH_ALEN) == 0) {
++ /* Shift for BSSID + BSSID info + Op_class + channel num + PHY type */
++ pos = pos + 6 + 4 + 1 + 1 + 1;
++
++ /* Iterate Subelement */
++ while (next_nr - pos > 0) {
++ if (*pos == 3) {
++ pos = pos + 2;
++ *pos = pref;
++ return;
++ } else {
++ pos++;
++ int shift_len = *pos++;
++ pos = pos + shift_len;
++ }
++ }
++ }
++ }
++}
++
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++ struct sta_info* sta, char *nei_buf, size_t buflen)
++{
++ struct hostapd_neighbor_entry *nr;
++ struct mbo_non_pref_chan_info *info;
++ u8 i;
++
++ for(info = sta->non_pref_chan; info; info = info->next) {
++ /* Check OP_Class and Channel num */
++ for(i = 0; i < info->num_channels; i++) {
++ char *pos, *next_nr;
++
++ pos = nei_buf;
++ next_nr = nei_buf;
++
++ /* Iterate Neighbor report database */
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ pos = next_nr;
++ next_nr = pos + 2 + wpabuf_len(nr->nr);
++ /**
++ * Shift 12 bytes for Element ID, Neighbor report length,
++ * BSSID and BSSID info.
++ */
++ pos = pos + 12;
++ int nr_op_class = *pos++;
++ int nr_channel = *pos;
++ if(info->op_class == nr_op_class && info->channels[i] == nr_channel) {
++ /* Shift for Channel Num + PHY type */
++ pos = pos + 1 + 1;
++
++ // Iterate Subelement
++ while(next_nr - pos > 0) {
++ if(*pos == 3) {
++ pos = pos + 2;
++ *pos = info->pref;
++ break;
++ }else {
++ pos++;
++ int shift_len = *pos++;
++ pos = pos + shift_len;
++ }
++ }
++ }
++ }
++ }
++ }
++}
++#endif
+diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
+index 992671b..a1ddc07 100644
+--- a/src/ap/neighbor_db.h
++++ b/src/ap/neighbor_db.h
+@@ -24,4 +24,13 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
+ const struct wpa_ssid_value *ssid);
+ void hostapd_free_neighbor_db(struct hostapd_data *hapd);
+
++int hostapd_neighbor_count(struct hostapd_data *hapd);
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++ size_t buflen);
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++ size_t buflen, const int pref);
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++ struct sta_info* sta, char *nei_buf, size_t buflen);
++#endif
+ #endif /* NEIGHBOR_DB_H */
+diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
+index 3ea92af..4349e1d 100644
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -20,6 +20,7 @@
+ #include "ap/wpa_auth.h"
+ #include "mbo_ap.h"
+ #include "wnm_ap.h"
++#include "ap/neighbor_db.h"
+
+ #define MAX_TFS_IE_LEN 1024
+
+@@ -370,9 +371,21 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ u8 *pos;
+ int res;
+
+- mgmt = os_zalloc(sizeof(*mgmt));
+- if (mgmt == NULL)
++ int nr_num = hostapd_neighbor_count(hapd);
++ int nr_size = ETH_ALEN + 4 + 1 + 1 + 1 + 5;
++ int total_nr_size = nr_num * nr_size;
++ u8 *nr_data = os_malloc(total_nr_size);
++ int nr_data_len = 0;
++ if(nr_data == NULL) {
++ wpa_printf (MSG_ERROR, "Failed to allocate memory");
++ } else {
++ nr_data_len = hostapd_neighbor_insert_buffer(hapd, nr_data, total_nr_size);
++ }
++ mgmt = os_zalloc(sizeof(*mgmt) + nr_data_len);
++ if (mgmt == NULL) {
++ wpa_printf (MSG_ERROR, "Failed to allocate memory for mgmt frame");
+ return -1;
++ }
+ os_memcpy(mgmt->da, addr, ETH_ALEN);
+ os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
+ os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
+@@ -382,10 +395,18 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ;
+ mgmt->u.action.u.bss_tm_req.dialog_token = dialog_token;
+ mgmt->u.action.u.bss_tm_req.req_mode = 0;
++ if(nr_num) {
++ mgmt->u.action.u.bss_tm_req.req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++ }
+ mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(0);
+ mgmt->u.action.u.bss_tm_req.validity_interval = 1;
+ pos = mgmt->u.action.u.bss_tm_req.variable;
+
++ if(nr_num) {
++ os_memcpy(pos, nr_data, nr_data_len);
++ pos += nr_data_len;
++ }
++
+ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
+ MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
+@@ -759,6 +780,50 @@ static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta,
+ }
+
+
++static void set_send_disassoc_frame_timer(struct hostapd_data *hapd, struct sta_info *sta,
++ int disassoc_timer)
++{
++ int timeout, beacon_int;
++
++ /*
++ * Prevent STA from reconnecting using cached PMKSA to force
++ * full authentication with the authentication server (which may
++ * decide to reject the connection),
++ */
++ wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
++
++ beacon_int = hapd->iconf->beacon_int;
++ if (beacon_int < 1)
++ beacon_int = 100; /* best guess */
++ /* Calculate timeout in ms based on beacon_int in TU */
++ timeout = disassoc_timer * beacon_int * 128 / 125;
++ wpa_printf(MSG_DEBUG, "Disassociation timer for " MACSTR
++ " set to %d ms", MAC2STR(sta->addr), timeout);
++
++ u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID;
++
++ hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
++ if (sta)
++ ap_sta_disassociate(hapd, sta, reason);
++}
++
++
++void bss_termination_disable_iface(void *eloop_ctx, void *timeout_ctx)
++{
++ struct hostapd_data *hapd = eloop_ctx;
++ hostapd_disable_iface(hapd->iface);
++}
++
++
++static void set_disable_iface_timer(struct hostapd_data *hapd, struct sta_info *sta,
++ int disable_iface_timer)
++{
++ wpa_printf(MSG_DEBUG, "Disable interface timer set to %d secs", disable_iface_timer);
++ eloop_register_timeout(disable_iface_timer, 0,
++ bss_termination_disable_iface, hapd, NULL);
++}
++
++
+ int wnm_send_ess_disassoc_imminent(struct hostapd_data *hapd,
+ struct sta_info *sta, const char *url,
+ int disassoc_timer)
+@@ -848,6 +913,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ bss_term_dur) {
+ os_memcpy(pos, bss_term_dur, 12);
+ pos += 12;
++ set_disable_iface_timer(hapd, sta, hapd->conf->bss_termination_tsf);
+ }
+
+ if (url) {
+@@ -884,7 +950,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ if (disassoc_timer) {
+ /* send disassociation frame after time-out */
+- set_disassoc_timer(hapd, sta, disassoc_timer);
++ set_send_disassoc_frame_timer(hapd, sta, disassoc_timer);
+ }
+
+ return 0;
+--
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.11/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch b/recipes-wifi/hostapd/files/patches-2.11/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
new file mode 100644
index 0000000..054dfb0
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
@@ -0,0 +1,36 @@
+From f5c37c459c33bb8e228a88ba8efdea68bb75abd3 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 20 Sep 2022 19:33:45 +0800
+Subject: [PATCH 99901/99909] hostapd: mtk: print sae groups by hostapd ctrl
+
+---
+ hostapd/ctrl_iface.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c2a2822..bc690c5 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1412,6 +1412,19 @@ static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
+ if (os_snprintf_error(buflen, res))
+ return -1;
+ return res;
++ } else if (os_strcmp(cmd, "sae_group_capability") == 0) {
++#ifdef CONFIG_SAE
++ /* see sae_set_group() */
++ res = os_snprintf(buf, buflen, "%s%s%s%s19 20 21",
++ dh_groups_get(15) ? "15 ": "",
++ dh_groups_get(16) ? "16 ": "",
++ dh_groups_get(17) ? "17 ": "",
++ dh_groups_get(18) ? "18 ": "");
++
++ if (os_snprintf_error(buflen, res))
++ return -1;
++ return res;
++#endif /* CONFIG_SAE */
+ }
+
+ return -1;
+--
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.11/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch b/recipes-wifi/hostapd/files/patches-2.11/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
new file mode 100644
index 0000000..6fa23c0
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
@@ -0,0 +1,211 @@
+From ce684a1adac0b5b699482924eb86f8f1b8205e57 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Tue, 31 May 2022 21:15:54 +0800
+Subject: [PATCH 99902/99909] hostapd: mtk: add support for runtime set in-band
+ discovery
+
+Usage:
+hostapd_cli unsolic_probe_resp [tx_type] [interval]
+
+0: disable all in-band discovery
+1: enable unsolicited probe response
+2: enable FILS discovery
+
+Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 66 ++++++++++++++++++++++++++++++++++++
+ hostapd/hostapd_cli.c | 20 +++++++++++
+ src/ap/beacon.c | 5 ++-
+ src/drivers/driver_nl80211.c | 10 ++++--
+ src/drivers/nl80211_copy.h | 1 +
+ 5 files changed, 98 insertions(+), 4 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index bc690c5..bb8c74f 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -826,6 +826,69 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
+
+ #endif /* CONFIG_INTERWORKING */
+
++static int hostapd_ctrl_iface_inband_discovery(struct hostapd_data *hapd,
++ const char *cmd)
++{
++ struct hostapd_bss_config *conf = hapd->conf;
++ const char *pos = cmd;
++ int tx_type, interval, ret;
++
++ tx_type = atoi(pos);
++ if (tx_type < 0 || tx_type > 2) {
++ wpa_printf(MSG_ERROR, "Invalid tx type\n");
++ return -1;
++ }
++
++ pos = os_strchr(pos, ' ');
++ if(!pos)
++ return -1;
++ pos++;
++ interval = atoi(pos);
++ if (interval < 0 || interval > 20) {
++ wpa_printf(MSG_ERROR, "Invalid interval value\n");
++ return -1;
++ }
++
++ wpa_printf(MSG_ERROR, "Set inband discovery type:%d, interval:%d\n",
++ tx_type, interval);
++
++#define DISABLE_INBAND_DISC 0
++#define UNSOL_PROBE_RESP 1
++#define FILS_DISCOVERY 2
++
++#ifdef CONFIG_FILS
++ conf->fils_discovery_max_int = 0;
++ conf->fils_discovery_min_int = 0;
++#endif /* CONFIG_FILS */
++ conf->unsol_bcast_probe_resp_interval = 0;
++
++ switch (tx_type) {
++ case DISABLE_INBAND_DISC:
++ default:
++ /* Disable both Unsolicited probe response and FILS discovery*/
++ break;
++ case UNSOL_PROBE_RESP:
++ /* Enable Unsolicited probe response */
++ conf->unsol_bcast_probe_resp_interval = interval;
++ break;
++#ifdef CONFIG_FILS
++ case FILS_DISCOVERY:
++ /* Enable FILS discovery */
++ conf->fils_discovery_min_int = interval;
++ conf->fils_discovery_max_int = interval;
++ break;
++#endif /* CONFIG_FILS */
++ }
++
++ ret = ieee802_11_update_beacons(hapd->iface);
++ if(ret) {
++ wpa_printf(MSG_DEBUG,
++ "Failed to update with inband discovery parameters\n");
++ return -1;
++ }
++
++ return 0;
++}
+
+ #ifdef CONFIG_WNM_AP
+
+@@ -3434,6 +3497,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ if (hostapd_ctrl_iface_coloc_intf_req(hapd, buf + 15))
+ reply_len = -1;
+ #endif /* CONFIG_WNM_AP */
++ } else if (os_strncmp(buf, "INBAND_DISCOVERY ", 17) == 0) {
++ if (hostapd_ctrl_iface_inband_discovery(hapd, buf + 17))
++ reply_len = -1;
+ } else if (os_strcmp(buf, "GET_CONFIG") == 0) {
+ reply_len = hostapd_ctrl_iface_get_config(hapd, reply,
+ reply_size);
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 85c41d0..db21258 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -642,6 +642,24 @@ static int hostapd_cli_cmd_wps_config(struct wpa_ctrl *ctrl, int argc,
+ return wpa_ctrl_command(ctrl, buf);
+ }
+
++static int hostapd_cli_cmd_inband_discovery(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ char buf[300];
++ int res;
++
++ if (argc < 2) {
++ printf("Invalid 'inband_discovery' command - two arguments"
++ "tx_type interval\n");
++ return -1;
++ }
++
++ res = os_snprintf(buf, sizeof(buf), "INBAND_DISCOVERY %s %s",
++ argv[0], argv[1]);
++ if (os_snprintf_error(sizeof(buf), res))
++ return -1;
++ return wpa_ctrl_command(ctrl, buf);
++}
+
+ static int hostapd_cli_cmd_disassoc_imminent(struct wpa_ctrl *ctrl, int argc,
+ char *argv[])
+@@ -1749,6 +1767,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ { "driver", hostapd_cli_cmd_driver, NULL,
+ "<driver sub command> [<hex formatted data>] = send driver command data" },
+ #endif /* ANDROID */
++ { "inband_discovery", hostapd_cli_cmd_inband_discovery, NULL,
++ "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
+ { NULL, NULL, NULL, NULL }
+ };
+
+diff --git a/src/ap/beacon.c b/src/ap/beacon.c
+index 814e86e..1a26f11 100644
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1497,6 +1497,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+ struct wpa_driver_ap_params *params)
+ {
+ params->fd_max_int = hapd->conf->fils_discovery_max_int;
++ params->unsol_bcast_probe_resp_interval =
++ hapd->conf->unsol_bcast_probe_resp_interval;
+ if (is_6ghz_op_class(hapd->iconf->op_class) &&
+ params->fd_max_int > FD_MAX_INTERVAL_6GHZ)
+ params->fd_max_int = FD_MAX_INTERVAL_6GHZ;
+@@ -1505,7 +1507,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+ if (params->fd_min_int > params->fd_max_int)
+ params->fd_min_int = params->fd_max_int;
+
+- if (params->fd_max_int)
++ if (params->fd_max_int || (is_6ghz_op_class(hapd->iconf->op_class) &&
++ !params->unsol_bcast_probe_resp_interval))
+ return hostapd_gen_fils_discovery(hapd,
+ ¶ms->fd_frame_tmpl_len);
+
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 53f2503..5eba0ea 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -4498,9 +4498,10 @@ static int nl80211_fils_discovery(struct i802_bss *bss, struct nl_msg *msg,
+ params->fd_max_int) ||
+ (params->fd_frame_tmpl &&
+ nla_put(msg, NL80211_FILS_DISCOVERY_ATTR_TMPL,
+- params->fd_frame_tmpl_len, params->fd_frame_tmpl)))
++ params->fd_frame_tmpl_len, params->fd_frame_tmpl)) ||
++ nla_put_u32(msg, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
++ params->unsol_bcast_probe_resp_interval))
+ return -1;
+-
+ nla_nest_end(msg, attr);
+ return 0;
+ }
+@@ -4844,7 +4845,10 @@ static int wpa_driver_nl80211_set_ap(void *priv,
+ #endif /* CONFIG_SAE */
+
+ #ifdef CONFIG_FILS
+- if (params->fd_max_int && nl80211_fils_discovery(bss, msg, params) < 0)
++ if ((params->fd_max_int ||
++ ((params->freq->freq > 5950 && params->freq->freq <= 7115) &&
++ !(params->unsol_bcast_probe_resp_interval))) &&
++ nl80211_fils_discovery(bss, msg, params) < 0)
+ goto fail;
+ #endif /* CONFIG_FILS */
+
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index 0568a79..c4bf3ad 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -7379,6 +7379,7 @@ enum nl80211_fils_discovery_attributes {
+ NL80211_FILS_DISCOVERY_ATTR_INT_MIN,
+ NL80211_FILS_DISCOVERY_ATTR_INT_MAX,
+ NL80211_FILS_DISCOVERY_ATTR_TMPL,
++ NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
+
+ /* keep last */
+ __NL80211_FILS_DISCOVERY_ATTR_LAST,
+--
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.11/99903-hostapd-mtk-Add-mtk_vendor.h.patch b/recipes-wifi/hostapd/files/patches-2.11/99903-hostapd-mtk-Add-mtk_vendor.h.patch
new file mode 100644
index 0000000..a15287e
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/99903-hostapd-mtk-Add-mtk_vendor.h.patch
@@ -0,0 +1,214 @@
+From e4b9b5847090d25009a4cf104052ba0490e95ffe Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Mon, 30 May 2022 15:04:57 +0800
+Subject: [PATCH 99903/99909] hostapd: mtk: Add mtk_vendor.h
+
+---
+ src/common/mtk_vendor.h | 195 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 195 insertions(+)
+ create mode 100644 src/common/mtk_vendor.h
+
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+new file mode 100644
+index 0000000..528387f
+--- /dev/null
++++ b/src/common/mtk_vendor.h
+@@ -0,0 +1,195 @@
++// SPDX-License-Identifier: ISC
++/* Copyright (C) 2020 Felix Fietkau <nbd@nbd.name> */
++#ifndef MTK_VENDOR_H
++#define MTK_VENDOR_H
++
++#define OUI_MTK 0x000ce7
++
++enum mtk_nl80211_vendor_subcmds {
++ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
++ MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
++ MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
++ MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++};
++
++enum mtk_vendor_attr_edcca_ctrl {
++ MTK_VENDOR_ATTR_EDCCA_THRESHOLD_INVALID = 0,
++
++ MTK_VENDOR_ATTR_EDCCA_CTRL_MODE,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
++};
++
++enum mtk_vendor_attr_edcca_ctrl_mode {
++ EDCCA_CTRL_SET_EN = 0,
++ EDCCA_CTRL_SET_THERS,
++ EDCCA_CTRL_GET_EN,
++ EDCCA_CTRL_GET_THERS,
++ EDCCA_CTRL_NUM,
++};
++
++static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
++};
++
++enum mtk_vendor_attr_csi_ctrl {
++ MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2,
++ MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR,
++ MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_DATA,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_CSI_CTRL,
++ MTK_VENDOR_ATTR_CSI_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_CSI_CTRL - 1
++};
++
++enum mtk_vendor_attr_csi_data {
++ MTK_VENDOR_ATTR_CSI_DATA_UNSPEC,
++ MTK_VENDOR_ATTR_CSI_DATA_PAD,
++
++ MTK_VENDOR_ATTR_CSI_DATA_VER,
++ MTK_VENDOR_ATTR_CSI_DATA_TS,
++ MTK_VENDOR_ATTR_CSI_DATA_RSSI,
++ MTK_VENDOR_ATTR_CSI_DATA_SNR,
++ MTK_VENDOR_ATTR_CSI_DATA_BW,
++ MTK_VENDOR_ATTR_CSI_DATA_CH_IDX,
++ MTK_VENDOR_ATTR_CSI_DATA_TA,
++ MTK_VENDOR_ATTR_CSI_DATA_I,
++ MTK_VENDOR_ATTR_CSI_DATA_Q,
++ MTK_VENDOR_ATTR_CSI_DATA_INFO,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD1,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD2,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD3,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD4,
++ MTK_VENDOR_ATTR_CSI_DATA_TX_ANT,
++ MTK_VENDOR_ATTR_CSI_DATA_RX_ANT,
++ MTK_VENDOR_ATTR_CSI_DATA_MODE,
++ MTK_VENDOR_ATTR_CSI_DATA_H_IDX,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_CSI_DATA,
++ MTK_VENDOR_ATTR_CSI_DATA_MAX =
++ NUM_MTK_VENDOR_ATTRS_CSI_DATA - 1
++};
++
++enum mtk_vendor_attr_mnt_ctrl {
++ MTK_VENDOR_ATTR_AMNT_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_CTRL_SET,
++ MTK_VENDOR_ATTR_AMNT_CTRL_DUMP,
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_CTRL,
++ MTK_VENDOR_ATTR_AMNT_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_CTRL - 1
++};
++
++enum mtk_vendor_attr_mnt_set {
++ MTK_VENDOR_ATTR_AMNT_SET_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_SET_INDEX,
++ MTK_VENDOR_ATTR_AMNT_SET_MACADDR,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_SET,
++ MTK_VENDOR_ATTR_AMNT_SET_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_SET - 1
++};
++
++enum mtk_vendor_attr_mnt_dump {
++ MTK_VENDOR_ATTR_AMNT_DUMP_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_DUMP_INDEX,
++ MTK_VENDOR_ATTR_AMNT_DUMP_LEN,
++ MTK_VENDOR_ATTR_AMNT_DUMP_RESULT,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_DUMP,
++ MTK_VENDOR_ATTR_AMNT_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_DUMP - 1
++};
++
++enum mtk_vendor_attr_wireless_ctrl {
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_OFDMA,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
++};
++
++enum mtk_vendor_attr_rfeature_ctrl {
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
++};
++
++#define CSI_MAX_COUNT 256
++#define ETH_ALEN 6
++
++struct csi_data {
++ s16 data_i[CSI_MAX_COUNT];
++ s16 data_q[CSI_MAX_COUNT];
++ s8 rssi;
++ u8 snr;
++ u32 ts;
++ u8 data_bw;
++ u8 pri_ch_idx;
++ u8 ta[ETH_ALEN];
++ u32 info;
++ u8 rx_mode;
++ u32 h_idx;
++ u16 tx_idx;
++ u16 rx_idx;
++};
++
++struct amnt_data {
++ u8 idx;
++ u8 addr[ETH_ALEN];
++ s8 rssi[4];
++ u32 last_seen;
++};
++#endif /* MTK_VENDOR_H */
+--
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.11/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch b/recipes-wifi/hostapd/files/patches-2.11/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
new file mode 100644
index 0000000..40dded6
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
@@ -0,0 +1,619 @@
+From cef7f515eafeeaa99933cc9e66c79b705e3ab065 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Mon, 30 May 2022 16:31:34 +0800
+Subject: [PATCH 99904/99909] hostapd: mtk: Support EDCCA hostapd configuration
+
+edcca_enable and edcca_compensation and implement edcca related handlers.
+---
+ hostapd/config_file.c | 32 ++++++
+ hostapd/ctrl_iface.c | 125 ++++++++++++++++++++++
+ src/ap/ap_config.c | 4 +
+ src/ap/ap_config.h | 29 ++++++
+ src/ap/ap_drv_ops.c | 24 +++++
+ src/ap/ap_drv_ops.h | 5 +-
+ src/ap/hostapd.c | 7 ++
+ src/common/mtk_vendor.h | 19 ++--
+ src/drivers/driver.h | 4 +
+ src/drivers/driver_nl80211.c | 165 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 7 ++
+ 12 files changed, 415 insertions(+), 7 deletions(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index eda9db0..0ee8952 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4753,6 +4753,38 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ } else if (os_strcmp(buf, "eht_mu_beamformer") == 0) {
+ conf->eht_phy_capab.mu_beamformer = atoi(pos);
+ #endif /* CONFIG_IEEE80211BE */
++ } else if (os_strcmp(buf, "edcca_threshold") == 0) {
++ if (hostapd_parse_intlist(&conf->edcca_threshold, pos) ||
++ conf->edcca_threshold[0] < EDCCA_MIN_CONFIG_THRES ||
++ conf->edcca_threshold[0] > EDCCA_MAX_CONFIG_THRES ||
++ conf->edcca_threshold[1] < EDCCA_MIN_CONFIG_THRES ||
++ conf->edcca_threshold[1] > EDCCA_MAX_CONFIG_THRES ||
++ conf->edcca_threshold[2] < EDCCA_MIN_CONFIG_THRES ||
++ conf->edcca_threshold[2] > EDCCA_MAX_CONFIG_THRES) {
++ wpa_printf(MSG_ERROR, "Line %d: invalid edcca threshold",
++ line);
++ return 1;
++ }
++ } else if (os_strcmp(buf, "edcca_enable") == 0) {
++ int mode = atoi(pos);
++ if (mode < EDCCA_MODE_FORCE_DISABLE || mode > EDCCA_MODE_AUTO) {
++ wpa_printf(MSG_ERROR, "Line %d: Invalid edcca_enable %d;"
++ " allowed value 0 (Force Disable) or 1(Auto) ",
++ line, mode);
++ return 1;
++ }
++ conf->edcca_enable = (u8) mode;
++ } else if (os_strcmp(buf, "edcca_compensation") == 0) {
++ int val = atoi(pos);
++ if (val < EDCCA_MIN_COMPENSATION ||
++ val > EDCCA_MAX_COMPENSATION) {
++ wpa_printf(MSG_ERROR, "Line %d: Invalid compensation"
++ " value %d; allowed value %d ~ %d.",
++ line, val, EDCCA_MIN_COMPENSATION,
++ EDCCA_MAX_COMPENSATION);
++ return 1;
++ }
++ conf->edcca_compensation = (s8) val;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index bb8c74f..9c70d54 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -598,6 +598,19 @@ static const char * pbc_status_str(enum pbc_status status)
+ }
+
+
++static const char * edcca_mode_str(enum edcca_mode status)
++{
++ switch (status) {
++ case EDCCA_MODE_FORCE_DISABLE:
++ return "Force Disable";
++ case EDCCA_MODE_AUTO:
++ return "Auto";
++ default:
++ return "Unknown";
++ }
++}
++
++
+ static int hostapd_ctrl_iface_wps_get_status(struct hostapd_data *hapd,
+ char *buf, size_t buflen)
+ {
+@@ -3322,6 +3335,112 @@ static int hostapd_ctrl_iface_driver_cmd(struct hostapd_data *hapd, char *cmd,
+ #endif /* ANDROID */
+
+
++static int
++hostapd_ctrl_iface_set_edcca(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *pos, *config, *value;
++ config = cmd;
++ pos = os_strchr(config, ' ');
++ if (pos == NULL)
++ return -1;
++ *pos++ = '\0';
++
++ if(pos == NULL)
++ return -1;
++ value = pos;
++
++ if (os_strcmp(config, "enable") == 0) {
++ int mode = atoi(value);
++ if (mode < EDCCA_MODE_FORCE_DISABLE || mode > EDCCA_MODE_AUTO) {
++ wpa_printf(MSG_ERROR, "Invalid value for edcca enable");
++ return -1;
++ }
++ hapd->iconf->edcca_enable = (u8) mode;
++ if (hostapd_drv_configure_edcca_enable(hapd) != 0)
++ return -1;
++ } else if (os_strcmp(config, "compensation") == 0) {
++ int compensation = atoi(value);
++ if (compensation < EDCCA_MIN_COMPENSATION ||
++ compensation > EDCCA_MAX_COMPENSATION) {
++ wpa_printf(MSG_ERROR, "Invalid value for edcca compensation");
++ return -1;
++ }
++ hapd->iconf->edcca_compensation = (s8) compensation;
++ if (hostapd_drv_configure_edcca_enable(hapd) != 0)
++ return -1;
++ } else if (os_strcmp(config, "threshold") == 0) {
++ char *thres_value;
++ thres_value = os_strchr(value, ':');
++ if (thres_value == NULL)
++ return -1;
++ *thres_value++ = '\0';
++
++ if(thres_value == NULL)
++ return -1;
++ int bw_idx= atoi(value);
++ int threshold = atoi(thres_value);
++
++ if (bw_idx < EDCCA_BW_20 || bw_idx > EDCCA_BW_80) {
++ wpa_printf(MSG_ERROR,
++ "Unsupported Bandwidth idx %d for SET_EDCCA",
++ bw_idx);
++ return -1;
++ }
++ if (threshold < EDCCA_MIN_CONFIG_THRES ||
++ threshold > EDCCA_MAX_CONFIG_THRES) {
++ wpa_printf(MSG_ERROR,
++ "Unsupported threshold %d for SET_EDCCA",
++ threshold);
++ return -1;
++ }
++
++ int threshold_arr[EDCCA_MAX_BW_NUM];
++ /* 0x7f means keep the origival value in firmware */
++ os_memset(threshold_arr, 0x7f, sizeof(threshold_arr));
++ threshold_arr[bw_idx] = threshold;
++
++ if (hostapd_drv_configure_edcca_threshold(hapd, threshold_arr) != 0)
++ return -1;
++ } else {
++ wpa_printf(MSG_ERROR,
++ "Unsupported parameter %s for SET_EDCCA", config);
++ return -1;
++ }
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++
++static int
++hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
++ size_t buflen)
++{
++ char *pos, *end;
++
++ pos = buf;
++ end = buf + buflen;
++ u8 value[EDCCA_MAX_BW_NUM] = {0};
++
++ if (os_strcmp(cmd, "enable") == 0) {
++ return os_snprintf(pos, end - pos, "Enable: %s\n",
++ edcca_mode_str(hapd->iconf->edcca_enable));
++ } else if (os_strcmp(cmd, "compensation") == 0) {
++ return os_snprintf(pos, end - pos, "Compensation: %d\n",
++ hapd->iconf->edcca_compensation);
++ } else if (os_strcmp(cmd, "threshold") == 0) {
++ if (hostapd_drv_get_edcca(hapd, EDCCA_CTRL_GET_THRES, &value) != 0)
++ return -1;
++ return os_snprintf(pos, end - pos,
++ "Threshold BW20: 0x%x, BW40: 0x%x, BW80: 0x%x\n",
++ value[0], value[1], value[2]);
++ } else {
++ wpa_printf(MSG_ERROR,
++ "Unsupported parameter %s for GET_EDCCA", cmd);
++ return -1;
++ }
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -3868,6 +3987,12 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_len = hostapd_ctrl_iface_driver_cmd(hapd, buf + 7, reply,
+ reply_size);
+ #endif /* ANDROID */
++ } else if (os_strncmp(buf, "SET_EDCCA ", 10) == 0) {
++ reply_len = hostapd_ctrl_iface_set_edcca(hapd, buf+10, reply,
++ reply_size);
++ } else if (os_strncmp(buf, "GET_EDCCA ", 10) == 0) {
++ reply_len = hostapd_ctrl_iface_get_edcca(hapd, buf+10, reply,
++ reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 4a20eb4..344585a 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -294,6 +294,9 @@ struct hostapd_config * hostapd_config_defaults(void)
+ conf->airtime_update_interval = AIRTIME_DEFAULT_UPDATE_INTERVAL;
+ #endif /* CONFIG_AIRTIME_POLICY */
+
++ conf->edcca_enable = EDCCA_MODE_AUTO;
++ conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
++
+ return conf;
+ }
+
+@@ -1007,6 +1010,7 @@ void hostapd_config_free(struct hostapd_config *conf)
+ #ifdef CONFIG_ACS
+ os_free(conf->acs_chan_bias);
+ #endif /* CONFIG_ACS */
++ os_free(conf->edcca_threshold);
+ wpabuf_free(conf->lci);
+ wpabuf_free(conf->civic);
+
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 3f68e76..775c567 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1153,8 +1153,37 @@ struct hostapd_config {
+ #define CH_SWITCH_EHT_ENABLED BIT(0)
+ #define CH_SWITCH_EHT_DISABLED BIT(1)
+ unsigned int ch_switch_eht_config;
++ u8 edcca_enable;
++ s8 edcca_compensation;
++ int *edcca_threshold;
+ };
+
++enum edcca_mode {
++ EDCCA_MODE_FORCE_DISABLE = 0,
++ EDCCA_MODE_AUTO = 1,
++};
++
++enum edcca_bw_id {
++ EDCCA_BW_20 = 0,
++ EDCCA_BW_40,
++ EDCCA_BW_80,
++ EDCCA_MAX_BW_NUM,
++};
++
++enum mtk_vendor_attr_edcca_ctrl_mode {
++ EDCCA_CTRL_SET_EN = 0,
++ EDCCA_CTRL_SET_THRES,
++ EDCCA_CTRL_GET_EN,
++ EDCCA_CTRL_GET_THRES,
++ EDCCA_CTRL_NUM,
++};
++
++#define EDCCA_DEFAULT_COMPENSATION -6
++#define EDCCA_MIN_COMPENSATION -126
++#define EDCCA_MAX_COMPENSATION 126
++#define EDCCA_MIN_CONFIG_THRES -126
++#define EDCCA_MAX_CONFIG_THRES 0
++
+
+ static inline enum oper_chan_width
+ hostapd_get_oper_chwidth(struct hostapd_config *conf)
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 0c7aee2..25e967d 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1015,3 +1015,27 @@ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable)
+ return 0;
+ return hapd->driver->dpp_listen(hapd->drv_priv, enable);
+ }
++
++int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->configure_edcca_enable)
++ return 0;
++ return hapd->driver->configure_edcca_enable(hapd->drv_priv,
++ hapd->iconf->edcca_enable,
++ hapd->iconf->edcca_compensation);
++}
++
++int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
++ const int *threshold)
++{
++ if (!hapd->driver || !hapd->driver->configure_edcca_threshold)
++ return 0;
++ return hapd->driver->configure_edcca_threshold(hapd->drv_priv, threshold);
++}
++
++int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
++{
++ if (!hapd->driver || !hapd->driver->get_edcca)
++ return 0;
++ return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index b4fb766..70a99f4 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -138,7 +138,10 @@ int hostapd_drv_do_acs(struct hostapd_data *hapd);
+ int hostapd_drv_update_dh_ie(struct hostapd_data *hapd, const u8 *peer,
+ u16 reason_code, const u8 *ie, size_t ielen);
+ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable);
+-
++int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
++int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
++ const int *threshold);
++int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 0dd8c13..d05f948 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2295,6 +2295,13 @@ dfs_offload:
+ }
+ #endif /* CONFIG_MESH */
+
++ if (hostapd_drv_configure_edcca_enable(hapd) < 0)
++ goto fail;
++
++ if (hostapd_drv_configure_edcca_threshold(hapd,
++ hapd->iconf->edcca_threshold) < 0)
++ goto fail;
++
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+ if (iface->interfaces && iface->interfaces->terminate_on_error > 0)
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 528387f..7056126 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -29,14 +29,21 @@ enum mtk_vendor_attr_edcca_ctrl {
+ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
+ };
+
+-enum mtk_vendor_attr_edcca_ctrl_mode {
+- EDCCA_CTRL_SET_EN = 0,
+- EDCCA_CTRL_SET_THERS,
+- EDCCA_CTRL_GET_EN,
+- EDCCA_CTRL_GET_THERS,
+- EDCCA_CTRL_NUM,
++enum mtk_vendor_attr_edcca_dump {
++ MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
++
++ MTK_VENDOR_ATTR_EDCCA_DUMP_MODE,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
+ };
+
++
+ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+ [MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
+ [MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 1d2b1b2..3559974 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4676,6 +4676,10 @@ struct wpa_driver_ops {
+ const u8 *match, size_t match_len,
+ bool multicast);
+ #endif /* CONFIG_TESTING_OPTIONS */
++ int (*configure_edcca_enable)(void *priv, const u8 edcca_enable,
++ const s8 edcca_compensation);
++ int (*configure_edcca_threshold)(void *priv, const int *threshold);
++ int (*get_edcca)(void *priv, const u8 mode, u8 *value);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 5eba0ea..9c2782c 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -35,6 +35,8 @@
+ #include "radiotap_iter.h"
+ #include "rfkill.h"
+ #include "driver_nl80211.h"
++#include "common/mtk_vendor.h"
++#include "ap/ap_config.h"
+
+
+ #ifndef NETLINK_CAP_ACK
+@@ -12368,6 +12370,165 @@ static int testing_nl80211_radio_disable(void *priv, int disabled)
+
+ #endif /* CONFIG_TESTING_OPTIONS */
+
++static int nl80211_configure_edcca_enable(void *priv,
++ const u8 edcca_enable,
++ const s8 edcca_compensation)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_edcca_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting EDCCA enable");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, EDCCA_CTRL_SET_EN) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL, edcca_enable) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
++ edcca_compensation)) {
++ wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to configure EDCCA enable. ret=%d (%s) ",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
++
++static int nl80211_configure_edcca_threshold(void *priv, const int *threshold)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_edcca_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting EDCCA threshold");
++ return 0;
++ }
++
++ if (!threshold) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Input EDCCA threshold is empty!");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, EDCCA_CTRL_SET_THRES) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL, threshold[0] & 0xff) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL, threshold[1] & 0xff) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL, threshold[2] & 0xff)) {
++ wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to configure EDCCA threshold. ret=%d (%s) ",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
++
++
++static int edcca_info_handler(struct nl_msg *msg, void *arg)
++{
++ u8 *info = (u8*) arg;
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_MAX + 1];
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct nlattr *nl_vend, *attr;
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!nl_vend)
++ return NL_SKIP;
++
++ nla_parse(tb_vendor, MTK_VENDOR_ATTR_EDCCA_DUMP_MAX,
++ nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL");
++ return NL_SKIP;
++ }
++
++ *info++ = nla_get_u8(attr);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL");
++ return NL_SKIP;
++ }
++
++ *info++ = nla_get_u8(attr);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL");
++ return NL_SKIP;
++ }
++
++ *info = nla_get_u8(attr);
++ return NL_SKIP;
++}
++
++
++static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_edcca_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting EDCCA threshold");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, mode)) {
++ wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, edcca_info_handler, value, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to get EDCCA configuration. ret=%d (%s)",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
++
+
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+@@ -12514,4 +12675,8 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .register_frame = testing_nl80211_register_frame,
+ .radio_disable = testing_nl80211_radio_disable,
+ #endif /* CONFIG_TESTING_OPTIONS */
++/* Need ifdef CONFIG_DRIVER_NL80211_MTK */
++ .configure_edcca_enable = nl80211_configure_edcca_enable,
++ .configure_edcca_threshold = nl80211_configure_edcca_threshold,
++ .get_edcca = nl80211_get_edcca,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 6e40d55..13e5d24 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -181,6 +181,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int qca_do_acs:1;
+ unsigned int brcm_do_acs:1;
+ unsigned int uses_6ghz:1;
++ unsigned int mtk_edcca_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 7ede0d0..732ae29 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -18,6 +18,7 @@
+ #include "common/qca-vendor-attr.h"
+ #include "common/brcm_vendor.h"
+ #include "driver_nl80211.h"
++#include "common/mtk_vendor.h"
+
+
+ static int protocol_feature_handler(struct nl_msg *msg, void *arg)
+@@ -1050,6 +1051,12 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ break;
+ }
+ #endif /* CONFIG_DRIVER_NL80211_BRCM */
++ } else if (vinfo->vendor_id == OUI_MTK) {
++ switch (vinfo->subcmd) {
++ case MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL :
++ drv->mtk_edcca_vendor_cmd_avail = 1;
++ break;
++ }
+ }
+
+ wpa_printf(MSG_DEBUG, "nl80211: Supported vendor command: vendor_id=0x%x subcmd=%u",
+--
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.11/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch b/recipes-wifi/hostapd/files/patches-2.11/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
new file mode 100644
index 0000000..18617be
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
@@ -0,0 +1,450 @@
+From a288f97e708bc579e285b509f7c0655c2f27a76c Mon Sep 17 00:00:00 2001
+From: TomLiu <tomml.liu@mediatek.com>
+Date: Tue, 9 Aug 2022 10:23:44 -0700
+Subject: [PATCH 99905/99909] hostapd: mtk: Add hostapd HEMU SET/GET control
+
+---
+ hostapd/config_file.c | 9 +++
+ hostapd/ctrl_iface.c | 62 +++++++++++++++++
+ hostapd/hostapd_cli.c | 18 +++++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 1 +
+ src/ap/ap_drv_ops.c | 14 ++++
+ src/ap/ap_drv_ops.h | 2 +
+ src/ap/hostapd.c | 2 +
+ src/common/mtk_vendor.h | 15 ++++
+ src/drivers/driver.h | 13 ++++
+ src/drivers/driver_nl80211.c | 110 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 3 +
+ 13 files changed, 251 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 0ee8952..b22d10b 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3659,6 +3659,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ return 1;
+ }
+ bss->unsol_bcast_probe_resp_interval = val;
++ } else if (os_strcmp(buf, "hemu_onoff") == 0) {
++ int val = atoi(pos);
++ if (val < 0 || val > 15) {
++ wpa_printf(MSG_ERROR,
++ "Line %d: invalid hemu_onoff value",
++ line);
++ return 1;
++ }
++ conf->hemu_onoff = val;
+ #endif /* CONFIG_IEEE80211AX */
+ } else if (os_strcmp(buf, "max_listen_interval") == 0) {
+ bss->max_listen_interval = atoi(pos);
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 9c70d54..5f71aee 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3441,6 +3441,63 @@ hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
+ }
+
+
++static int
++hostapd_ctrl_iface_set_hemu(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *pos, *config, *value;
++ config = cmd;
++ pos = os_strchr(config, ' ');
++ if (pos == NULL)
++ return -1;
++ *pos++ = '\0';
++
++ if(pos == NULL)
++ return -1;
++ value = pos;
++
++ if (os_strcmp(config, "onoff") == 0) {
++ int hemu = atoi(value);
++ if (hemu < 0 || hemu > 15) {
++ wpa_printf(MSG_ERROR, "Invalid value for hemu");
++ return -1;
++ }
++ hapd->iconf->hemu_onoff = (u8) hemu;
++ } else {
++ wpa_printf(MSG_ERROR,
++ "Unsupported parameter %s for SET_HEMU", config);
++ return -1;
++ }
++
++ if(hostapd_drv_hemu_ctrl(hapd) == 0) {
++ return os_snprintf(buf, buflen, "OK\n");
++ } else {
++ return -1;
++ }
++}
++
++
++static int
++hostapd_ctrl_iface_get_hemu(struct hostapd_data *hapd, char *buf,
++ size_t buflen)
++{
++ u8 hemu_onoff;
++ char *pos, *end;
++
++ pos = buf;
++ end = buf + buflen;
++
++ if (hostapd_drv_hemu_dump(hapd, &hemu_onoff) == 0) {
++ hapd->iconf->hemu_onoff = hemu_onoff;
++ return os_snprintf(pos, end - pos, "[hostapd_cli] = UL MU-MIMO: %d, DL MU-MIMO: %d, UL OFDMA: %d, DL OFDMA: %d\n",
++ !!(hemu_onoff&BIT(3)), !!(hemu_onoff&BIT(2)), !!(hemu_onoff&BIT(1)), !!(hemu_onoff&BIT(0)));
++ } else {
++ wpa_printf(MSG_INFO, "ctrl iface failed to call");
++ return -1;
++ }
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -3993,6 +4050,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ } else if (os_strncmp(buf, "GET_EDCCA ", 10) == 0) {
+ reply_len = hostapd_ctrl_iface_get_edcca(hapd, buf+10, reply,
+ reply_size);
++ } else if (os_strncmp(buf, "SET_HEMU ", 9) == 0) {
++ reply_len = hostapd_ctrl_iface_set_hemu(hapd, buf+9, reply,
++ reply_size);
++ } else if (os_strncmp(buf, "GET_HEMU", 8) == 0) {
++ reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index db21258..0d36477 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1380,6 +1380,20 @@ static int hostapd_cli_cmd_driver_flags(struct wpa_ctrl *ctrl, int argc,
+ }
+
+
++static int hostapd_cli_cmd_set_hemu(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "SET_HEMU", 1, argc, argv);
++}
++
++
++static int hostapd_cli_cmd_get_hemu(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "GET_HEMU", 0, NULL, NULL);
++}
++
++
+ #ifdef CONFIG_DPP
+
+ static int hostapd_cli_cmd_dpp_qr_code(struct wpa_ctrl *ctrl, int argc,
+@@ -1705,6 +1719,10 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ " = send FTM range request"},
+ { "driver_flags", hostapd_cli_cmd_driver_flags, NULL,
+ " = show supported driver flags"},
++ { "set_hemu", hostapd_cli_cmd_set_hemu, NULL,
++ "<value> [0-15] bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0)"},
++ { "get_hemu", hostapd_cli_cmd_get_hemu, NULL,
++ " = show hemu onoff value in 0-15 bitmap"},
+ #ifdef CONFIG_DPP
+ { "dpp_qr_code", hostapd_cli_cmd_dpp_qr_code, NULL,
+ "report a scanned DPP URI from a QR Code" },
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 344585a..0e1f192 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -280,6 +280,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ conf->he_6ghz_max_ampdu_len_exp = 7;
+ conf->he_6ghz_rx_ant_pat = 1;
+ conf->he_6ghz_tx_ant_pat = 1;
++ conf->hemu_onoff = 13;
+ #endif /* CONFIG_IEEE80211AX */
+
+ /* The third octet of the country string uses an ASCII space character
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 775c567..41b8c68 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1114,6 +1114,7 @@ struct hostapd_config {
+ u8 he_6ghz_rx_ant_pat;
+ u8 he_6ghz_tx_ant_pat;
+ u8 he_6ghz_reg_pwr_type;
++ u8 hemu_onoff;
+ #endif /* CONFIG_IEEE80211AX */
+
+ /* VHT enable/disable config from CHAN_SWITCH */
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 25e967d..4598737 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1039,3 +1039,17 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
+ return 0;
+ return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
+ }
++
++int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->hemu_ctrl)
++ return 0;
++ return hapd->driver->hemu_ctrl(hapd->drv_priv, hapd->iconf->hemu_onoff);
++}
++
++int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
++{
++ if (!hapd->driver || !hapd->driver->hemu_dump)
++ return 0;
++ return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 70a99f4..bca39c5 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -142,6 +142,8 @@ int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
+ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
+ const int *threshold);
+ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
++int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index d05f948..921769d 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2301,6 +2301,8 @@ dfs_offload:
+ if (hostapd_drv_configure_edcca_threshold(hapd,
+ hapd->iconf->edcca_threshold) < 0)
+ goto fail;
++ if (hostapd_drv_hemu_ctrl(hapd) < 0)
++ goto fail;
+
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 7056126..69a46df 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -10,6 +10,8 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
+ MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
+ MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
++ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
+ };
+
+@@ -174,6 +176,19 @@ enum mtk_vendor_attr_rfeature_ctrl {
+ NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
+ };
+
++enum mtk_vendor_attr_hemu_ctrl {
++ MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
++ MTK_VENDOR_ATTR_HEMU_CTRL_DUMP,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
++ MTK_VENDOR_ATTR_HEMU_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
++};
++
++
+ #define CSI_MAX_COUNT 256
+ #define ETH_ALEN 6
+
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 3559974..4cd7505 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1623,6 +1623,11 @@ struct wpa_driver_ap_params {
+ * Unsolicited broadcast Probe Response template length
+ */
+ size_t unsol_bcast_probe_resp_tmpl_len;
++
++ /**
++ * hemu onoff=<val> (bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0))
++ */
++ u8 hemu_onoff;
+ };
+
+ struct wpa_driver_mesh_bss_params {
+@@ -4680,6 +4685,14 @@ struct wpa_driver_ops {
+ const s8 edcca_compensation);
+ int (*configure_edcca_threshold)(void *priv, const int *threshold);
+ int (*get_edcca)(void *priv, const u8 mode, u8 *value);
++
++ /**
++ * hemu_ctrl - ctrl on off for UL/DL MURU
++ * @priv: Private driver interface data
++ *
++ */
++ int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
++ int (*hemu_dump)(void *priv, u8 *hemu_onoff);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 9c2782c..73dee2e 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12304,6 +12304,114 @@ fail:
+ }
+
+
++#ifdef CONFIG_IEEE80211AX
++static int nl80211_hemu_muruonoff(void *priv, u8 hemu_onoff)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_hemu_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting hemu control");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF, hemu_onoff)) {
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if(ret){
++ wpa_printf(MSG_ERROR, "Failed to set hemu_onoff. ret=%d (%s)", ret, strerror(-ret));
++ }
++ return ret;
++}
++
++
++static int hemu_dump_handler(struct nl_msg *msg, void *arg)
++{
++ u8 *hemu_onoff = (u8 *) arg;
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb_vendor[MTK_VENDOR_ATTR_HEMU_CTRL_MAX + 1];
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct nlattr *nl_vend, *attr;
++
++ static const struct nla_policy
++ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL + 1] = {
++ [MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_HEMU_CTRL_DUMP] = {.type = NLA_U8 },
++ };
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!nl_vend)
++ return NL_SKIP;
++
++ nla_parse(tb_vendor, MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
++ nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: cannot find MTK_VENDOR_ATTR_HEMU_CTRL_DUMP");
++ return NL_SKIP;
++ }
++
++ *hemu_onoff = nla_get_u8(attr);
++ wpa_printf(MSG_DEBUG, "nla_get hemu_onoff: %d\n", *hemu_onoff);
++
++ return 0;
++}
++
++static int nl80211_hemu_dump(void *priv, u8 *hemu_onoff)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *attr;
++ int ret;
++
++ if (!drv->mtk_hemu_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting hemu control");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL)) {
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++
++ attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++ if (!attr) {
++ nlmsg_free(msg);
++ return -1;
++ }
++
++ nla_nest_end(msg, attr);
++
++ ret = send_and_recv_msgs(drv, msg, hemu_dump_handler, hemu_onoff, NULL, NULL);
++
++ if(ret){
++ wpa_printf(MSG_ERROR, "Failed to get hemu_onoff. ret=%d (%s)", ret, strerror(-ret));
++ }
++
++ return ret;
++}
++#endif /* CONFIG_IEEE80211AX */
++
++
+ #ifdef CONFIG_DPP
+ static int nl80211_dpp_listen(void *priv, bool enable)
+ {
+@@ -12668,6 +12776,8 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .update_connect_params = nl80211_update_connection_params,
+ .send_external_auth_status = nl80211_send_external_auth_status,
+ .set_4addr_mode = nl80211_set_4addr_mode,
++ .hemu_ctrl = nl80211_hemu_muruonoff,
++ .hemu_dump = nl80211_hemu_dump,
+ #ifdef CONFIG_DPP
+ .dpp_listen = nl80211_dpp_listen,
+ #endif /* CONFIG_DPP */
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 13e5d24..57f0249 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -182,6 +182,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int brcm_do_acs:1;
+ unsigned int uses_6ghz:1;
+ unsigned int mtk_edcca_vendor_cmd_avail:1;
++ unsigned int mtk_hemu_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 732ae29..cc146d9 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1056,6 +1056,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ case MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL :
+ drv->mtk_edcca_vendor_cmd_avail = 1;
+ break;
++ case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
++ drv->mtk_hemu_vendor_cmd_avail = 1;
++ break;
+ }
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.11/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch b/recipes-wifi/hostapd/files/patches-2.11/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
new file mode 100644
index 0000000..fc81ed1
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
@@ -0,0 +1,247 @@
+From 26c6be11e7597490ccc4d7704542c78dec6c4cd1 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 2 Sep 2022 01:03:23 +0800
+Subject: [PATCH 99906/99909] hostapd: mtk: Add three wire PTA ctrl hostapd
+ vendor command
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c | 4 ++++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 13 ++++++++++++
+ src/ap/ap_drv_ops.c | 11 +++++++++++
+ src/ap/ap_drv_ops.h | 1 +
+ src/ap/hostapd.c | 2 ++
+ src/common/mtk_vendor.h | 16 +++++++++++++++
+ src/drivers/driver.h | 8 ++++++++
+ src/drivers/driver_nl80211.c | 33 +++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 3 +++
+ 11 files changed, 93 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index b22d10b..18b372a 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4794,6 +4794,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ return 1;
+ }
+ conf->edcca_compensation = (s8) val;
++ } else if (os_strcmp(buf, "three_wire_enable") == 0) {
++ u8 en = atoi(pos);
++
++ conf->three_wire_enable = en;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 0e1f192..9249a6b 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -297,6 +297,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+
+ conf->edcca_enable = EDCCA_MODE_AUTO;
+ conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
++ conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
+
+ return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 41b8c68..71cf515 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1157,6 +1157,19 @@ struct hostapd_config {
+ u8 edcca_enable;
+ s8 edcca_compensation;
+ int *edcca_threshold;
++ u8 three_wire_enable;
++};
++
++enum three_wire_mode {
++ THREE_WIRE_MODE_DISABLE,
++ THREE_WIRE_MODE_EXT0_ENABLE,
++ THREE_WIRE_MODE_EXT1_ENABLE,
++ THREE_WIRE_MODE_ALL_ENABLE,
++
++ /* keep last */
++ NUM_THREE_WIRE_MODE,
++ THREE_WIRE_MODE_MAX =
++ NUM_THREE_WIRE_MODE - 1
+ };
+
+ enum edcca_mode {
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 4598737..a1d83e4 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1053,3 +1053,14 @@ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
+ return 0;
+ return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
+ }
++
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->three_wire_ctrl)
++ return 0;
++ if (hapd->iconf->three_wire_enable > THREE_WIRE_MODE_MAX) {
++ wpa_printf(MSG_INFO, "Invalid value for three wire enable\n");
++ return 0;
++ }
++ return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index bca39c5..5ba6297 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -144,6 +144,7 @@ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
+ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+ int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 921769d..f9dabdf 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2303,6 +2303,8 @@ dfs_offload:
+ goto fail;
+ if (hostapd_drv_hemu_ctrl(hapd) < 0)
+ goto fail;
++ if (hostapd_drv_three_wire_ctrl(hapd) < 0)
++ goto fail;
+
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 69a46df..ee5a4f4 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++ MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
+ };
+
+ enum mtk_vendor_attr_edcca_ctrl {
+@@ -55,6 +56,21 @@ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+ [MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
+ };
+
++enum mtk_vendor_attr_3wire_ctrl {
++ MTK_VENDOR_ATTR_3WIRE_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_3WIRE_CTRL_MODE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL,
++ MTK_VENDOR_ATTR_3WIRE_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL - 1
++};
++
++static struct nla_policy three_wire_ctrl_policy[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL] = {
++ [MTK_VENDOR_ATTR_3WIRE_CTRL_MODE] = {.type = NLA_U8 },
++};
++
+ enum mtk_vendor_attr_csi_ctrl {
+ MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
+
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 4cd7505..9ca19af 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4693,6 +4693,14 @@ struct wpa_driver_ops {
+ */
+ int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
+ int (*hemu_dump)(void *priv, u8 *hemu_onoff);
++
++ /**
++ * three_wire_ctrl - set three_wire_ctrl mode
++ * @priv: Private driver interface data
++ * @three_wire_enable: three_wire_ctrl mode
++ *
++ */
++ int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 73dee2e..2bb8cc2 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12637,6 +12637,38 @@ static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
+ return ret;
+ }
+
++static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ /* Prepare nl80211 cmd */
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_3wire_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting three wire control");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_3WIRE_CTRL_MODE, three_wire_enable)) {
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to enable three wire. ret=%d (%s) ",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
+
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+@@ -12789,4 +12821,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .configure_edcca_enable = nl80211_configure_edcca_enable,
+ .configure_edcca_threshold = nl80211_configure_edcca_threshold,
+ .get_edcca = nl80211_get_edcca,
++ .three_wire_ctrl = nl80211_enable_three_wire,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 57f0249..9fe7811 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -183,6 +183,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int uses_6ghz:1;
+ unsigned int mtk_edcca_vendor_cmd_avail:1;
+ unsigned int mtk_hemu_vendor_cmd_avail:1;
++ unsigned int mtk_3wire_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index cc146d9..04bc54e 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1059,6 +1059,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
+ drv->mtk_hemu_vendor_cmd_avail = 1;
+ break;
++ case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
++ drv->mtk_3wire_vendor_cmd_avail = 1;
++ break;
+ }
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.11/99907-hostapd-mtk-Add-hostapd-iBF-control.patch b/recipes-wifi/hostapd/files/patches-2.11/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
new file mode 100644
index 0000000..50a08ba
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
@@ -0,0 +1,431 @@
+From 1f60afd21c6dd7dfe3d504dee7507654a981033b Mon Sep 17 00:00:00 2001
+From: mtk27835 <shurong.wen@mediatek.com>
+Date: Wed, 7 Sep 2022 14:41:51 -0700
+Subject: [PATCH 99907/99909] hostapd: mtk: Add hostapd iBF control
+
+Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
+---
+ hostapd/config_file.c | 3 +
+ hostapd/ctrl_iface.c | 26 +++++++
+ hostapd/hostapd_cli.c | 9 +++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 2 +
+ src/ap/ap_drv_ops.c | 14 ++++
+ src/ap/ap_drv_ops.h | 2 +
+ src/ap/hostapd.c | 2 +
+ src/common/mtk_vendor.h | 35 +++++++++-
+ src/drivers/driver.h | 19 ++++++
+ src/drivers/driver_nl80211.c | 108 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 3 +
+ 13 files changed, 224 insertions(+), 1 deletion(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 18b372a..d9d882c 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4798,6 +4798,9 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ u8 en = atoi(pos);
+
+ conf->three_wire_enable = en;
++ } else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
++ int val = atoi(pos);
++ conf->ibf_enable = !!val;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 5f71aee..c881d37 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3498,6 +3498,30 @@ hostapd_ctrl_iface_get_hemu(struct hostapd_data *hapd, char *buf,
+ }
+
+
++static int
++hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
++ size_t buflen)
++{
++ u8 ibf_enable;
++ int ret;
++ char *pos, *end;
++
++ pos = buf;
++ end = buf + buflen;
++
++ if (hostapd_drv_ibf_dump(hapd, &ibf_enable) == 0) {
++ hapd->iconf->ibf_enable = ibf_enable;
++ ret = os_snprintf(pos, end - pos, "ibf_enable: %u\n",
++ ibf_enable);
++ }
++
++ if (os_snprintf_error(end - pos, ret))
++ return 0;
++
++ return ret;
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -4055,6 +4079,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_size);
+ } else if (os_strncmp(buf, "GET_HEMU", 8) == 0) {
+ reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
++ } else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
++ reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 0d36477..c2a123a 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1586,6 +1586,13 @@ static int hostapd_cli_cmd_driver(struct wpa_ctrl *ctrl, int argc, char *argv[])
+ #endif /* ANDROID */
+
+
++static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "GET_IBF", 0, NULL, NULL);
++}
++
++
+ struct hostapd_cli_cmd {
+ const char *cmd;
+ int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
+@@ -1787,6 +1794,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ #endif /* ANDROID */
+ { "inband_discovery", hostapd_cli_cmd_inband_discovery, NULL,
+ "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
++ { "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
++ " = show iBF state (enabled/disabled)"},
+ { NULL, NULL, NULL, NULL }
+ };
+
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 9249a6b..7a96cb8 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -298,6 +298,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ conf->edcca_enable = EDCCA_MODE_AUTO;
+ conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
+ conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
++ conf->ibf_enable = IBF_DEFAULT_ENABLE;
+
+ return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 71cf515..44a0e7e 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1158,6 +1158,7 @@ struct hostapd_config {
+ s8 edcca_compensation;
+ int *edcca_threshold;
+ u8 three_wire_enable;
++ u8 ibf_enable;
+ };
+
+ enum three_wire_mode {
+@@ -1198,6 +1199,7 @@ enum mtk_vendor_attr_edcca_ctrl_mode {
+ #define EDCCA_MIN_CONFIG_THRES -126
+ #define EDCCA_MAX_CONFIG_THRES 0
+
++#define IBF_DEFAULT_ENABLE 0
+
+ static inline enum oper_chan_width
+ hostapd_get_oper_chwidth(struct hostapd_config *conf)
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index a1d83e4..60ae825 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1064,3 +1064,17 @@ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
+ }
+ return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
+ }
++
++int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->ibf_ctrl)
++ return 0;
++ return hapd->driver->ibf_ctrl(hapd->drv_priv, hapd->iconf->ibf_enable);
++}
++
++int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
++{
++ if (!hapd->driver || !hapd->driver->ibf_dump)
++ return 0;
++ return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
++}
+\ No newline at end of file
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 5ba6297..ab9aedc 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -145,6 +145,8 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+ int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index f9dabdf..e44b73d 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2305,6 +2305,8 @@ dfs_offload:
+ goto fail;
+ if (hostapd_drv_three_wire_ctrl(hapd) < 0)
+ goto fail;
++ if (hostapd_drv_ibf_ctrl(hapd) < 0)
++ goto fail;
+
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index ee5a4f4..4050cf8 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -13,7 +13,8 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
+- MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
++ MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
++ MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
+ };
+
+ enum mtk_vendor_attr_edcca_ctrl {
+@@ -204,6 +205,38 @@ enum mtk_vendor_attr_hemu_ctrl {
+ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
+ };
+
++enum mtk_vendor_attr_ibf_ctrl {
++ MTK_VENDOR_ATTR_IBF_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_IBF_CTRL_ENABLE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_IBF_CTRL,
++ MTK_VENDOR_ATTR_IBF_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_IBF_CTRL - 1
++};
++
++enum mtk_vendor_attr_ibf_dump {
++ MTK_VENDOR_ATTR_IBF_DUMP_UNSPEC,
++
++ MTK_VENDOR_ATTR_IBF_DUMP_ENABLE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_IBF_DUMP,
++ MTK_VENDOR_ATTR_IBF_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_IBF_DUMP - 1
++};
++
++static struct nla_policy
++ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
++ [MTK_VENDOR_ATTR_IBF_CTRL_ENABLE] = { .type = NLA_U8 },
++};
++
++static struct nla_policy
++ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
++ [MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
++};
++
+
+ #define CSI_MAX_COUNT 256
+ #define ETH_ALEN 6
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 9ca19af..71ded61 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1628,6 +1628,11 @@ struct wpa_driver_ap_params {
+ * hemu onoff=<val> (bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0))
+ */
+ u8 hemu_onoff;
++
++ /**
++ * ibf_enable=<val>
++ */
++ u8 ibf_enable;
+ };
+
+ struct wpa_driver_mesh_bss_params {
+@@ -4701,6 +4706,20 @@ struct wpa_driver_ops {
+ *
+ */
+ int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
++
++ /**
++ * ibf_ctrl - ctrl disable/enable for ibf
++ * @priv: Private driver interface data
++ *
++ */
++ int (*ibf_ctrl)(void *priv, u8 ibf_enable);
++
++ /**
++ * ibf_dump - dump ibf
++ * @priv: Private driver interface data
++ *
++ */
++ int (*ibf_dump)(void *priv, u8 *ibf_enable);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 2bb8cc2..e974f85 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12670,6 +12670,112 @@ static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
+ return ret;
+ }
+
++static int nl80211_ibf_enable(void *priv, u8 ibf_enable)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_ibf_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting ibf control");
++ return 0;
++ }
++
++ msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++ if (!data)
++ goto fail;
++
++ nla_put_u8(msg, MTK_VENDOR_ATTR_IBF_CTRL_ENABLE, ibf_enable);
++
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to set ibf_enable. ret=%d (%s)", ret, strerror(-ret));
++ }
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++}
++
++static int ibf_dump_handler(struct nl_msg *msg, void *arg)
++{
++ u8 *ibf_enable = (u8 *) arg;
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb_vendor[MTK_VENDOR_ATTR_IBF_DUMP_MAX + 1];
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct nlattr *nl_vend, *attr;
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!nl_vend)
++ return NL_SKIP;
++
++ nla_parse(tb_vendor, MTK_VENDOR_ATTR_IBF_DUMP_MAX,
++ nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: cannot find MTK_VENDOR_ATTR_IBF_DUMP_ENABLE");
++ return NL_SKIP;
++ }
++
++ *ibf_enable = nla_get_u8(attr);
++
++ return NL_SKIP;
++}
++
++static int
++nl80211_ibf_dump(void *priv, u8 *ibf_enable)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
++ if (!data)
++ goto fail;
++
++ nla_nest_end(msg, data);
++
++ ret = send_and_recv_msgs(drv, msg, ibf_dump_handler, ibf_enable, NULL, NULL);
++
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to dump ibf_enable. ret=%d (%s)", ret, strerror(-ret));
++ }
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+ .desc = "Linux nl80211/cfg80211",
+@@ -12822,4 +12928,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .configure_edcca_threshold = nl80211_configure_edcca_threshold,
+ .get_edcca = nl80211_get_edcca,
+ .three_wire_ctrl = nl80211_enable_three_wire,
++ .ibf_ctrl = nl80211_ibf_enable,
++ .ibf_dump = nl80211_ibf_dump,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 9fe7811..607592c 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -184,6 +184,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int mtk_edcca_vendor_cmd_avail:1;
+ unsigned int mtk_hemu_vendor_cmd_avail:1;
+ unsigned int mtk_3wire_vendor_cmd_avail:1;
++ unsigned int mtk_ibf_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 04bc54e..9ecc0ff 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1062,6 +1062,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
+ drv->mtk_3wire_vendor_cmd_avail = 1;
+ break;
++ case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
++ drv->mtk_ibf_vendor_cmd_avail = 1;
++ break;
+ }
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.11/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch b/recipes-wifi/hostapd/files/patches-2.11/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
new file mode 100644
index 0000000..9b96d98
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
@@ -0,0 +1,27 @@
+From 28228a96980512f30c8c8aac0f819c36f7241b68 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 22 Sep 2022 16:08:09 +0800
+Subject: [PATCH 99908/99909] hostapd: mtk: Do not include HE capab IE if
+ associated sta's HE capab IE is invalid
+
+---
+ src/ap/ieee802_11.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
+index d921783..098793e 100644
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -5192,7 +5192,8 @@ static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
+ #endif /* CONFIG_IEEE80211AC */
+
+ #ifdef CONFIG_IEEE80211AX
+- if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax) {
++ if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax &&
++ sta->flags & WLAN_STA_HE) {
+ p = hostapd_eid_he_capab(hapd, p, IEEE80211_MODE_AP);
+ p = hostapd_eid_he_operation(hapd, p);
+ p = hostapd_eid_cca(hapd, p);
+--
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.11/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch b/recipes-wifi/hostapd/files/patches-2.11/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
new file mode 100644
index 0000000..8da9b5f
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
@@ -0,0 +1,376 @@
+From 737d21c64ab0ac49e9cce7185f1f79bb0b71f50e Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 7 Oct 2022 10:46:29 +0800
+Subject: [PATCH 99909/99909] hostapd: mtk: Add DFS and ZWDFS support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c | 4 ++
+ hostapd/ctrl_iface.c | 95 ++++++++++++++++++++++++++++++++++++
+ src/ap/ap_config.h | 13 +++++
+ src/ap/dfs.c | 35 +++++++------
+ src/ap/dfs.h | 15 ++++++
+ src/ap/hostapd.c | 4 +-
+ src/drivers/driver.h | 7 +++
+ src/drivers/driver_nl80211.c | 29 +++++++++++
+ src/drivers/nl80211_copy.h | 1 +
+ 9 files changed, 186 insertions(+), 17 deletions(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index d9d882c..fd61448 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4801,6 +4801,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ } else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
+ int val = atoi(pos);
+ conf->ibf_enable = !!val;
++ } else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
++ u8 en = strtol(pos, NULL, 10);
++
++ conf->dfs_detect_mode = en;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c881d37..6ea1573 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3522,6 +3522,96 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
+ }
+
+
++static int
++hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
++ char *buf, size_t buflen)
++{
++ u8 dfs_detect_mode;
++
++ if (!value)
++ return -1;
++
++ dfs_detect_mode = strtol(value, NULL, 10);
++ if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
++ wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
++ return -1;
++ }
++ hapd->iconf->dfs_detect_mode = dfs_detect_mode;
++
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++
++static int
++hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ struct hostapd_iface *iface = hapd->iface;
++ char *pos, *param;
++ enum hostapd_hw_mode hw_mode;
++ bool chan_found = false;
++ int i, num_available_chandefs, channel, chan_width, sec = 0;
++ int sec_chan_idx_80p80 = -1;
++ u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
++ struct hostapd_channel_data *chan;
++ enum dfs_channel_type type = DFS_NO_CAC_YET;
++
++ param = os_strchr(cmd, ' ');
++ if (!param)
++ return -1;
++ *param++ = '\0';
++
++ pos = os_strstr(param, "chan=");
++ if (pos)
++ channel = strtol(pos + 5, NULL, 10);
++ else
++ return -1;
++
++ num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
++ for (i = 0; i < num_available_chandefs; i++) {
++ dfs_find_channel(iface, &chan, i, type);
++ if (chan->chan == channel) {
++ chan_found = true;
++ break;
++ }
++ }
++
++ if (!chan_found)
++ return -1;
++
++ if (iface->conf->secondary_channel)
++ sec = 1;
++
++ dfs_adjust_center_freq(iface, chan,
++ sec,
++ sec_chan_idx_80p80,
++ &oper_centr_freq_seg0_idx,
++ &oper_centr_freq_seg1_idx);
++
++ if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
++ chan->freq, chan->chan,
++ iface->conf->ieee80211n,
++ iface->conf->ieee80211ac,
++ iface->conf->ieee80211ax,
++ iface->conf->ieee80211be,
++ sec, hostapd_get_oper_chwidth(iface->conf),
++ oper_centr_freq_seg0_idx,
++ oper_centr_freq_seg1_idx, true)) {
++ wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
++ iface->radar_background.channel = -1;
++ return -1;
++ }
++
++ iface->radar_background.channel = chan->chan;
++ iface->radar_background.freq = chan->freq;
++ iface->radar_background.secondary_channel = sec;
++ iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
++ iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
++
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -4081,6 +4171,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ } else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
+ reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
++ } else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
++ reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
++ reply, reply_size);
++ } else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
++ reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 44a0e7e..3f5afdf 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1159,6 +1159,7 @@ struct hostapd_config {
+ int *edcca_threshold;
+ u8 three_wire_enable;
+ u8 ibf_enable;
++ u8 dfs_detect_mode;
+ };
+
+ enum three_wire_mode {
+@@ -1173,6 +1174,18 @@ enum three_wire_mode {
+ NUM_THREE_WIRE_MODE - 1
+ };
+
++enum dfs_mode {
++ DFS_DETECT_MODE_DISABLE,
++ DFS_DETECT_MODE_AP_ENABLE,
++ DFS_DETECT_MODE_BACKGROUND_ENABLE,
++ DFS_DETECT_MODE_ALL_ENABLE,
++
++ /* keep last */
++ NUM_DFS_DETECT_MODE,
++ DFS_DETECT_MODE_MAX =
++ NUM_DFS_DETECT_MODE - 1
++};
++
+ enum edcca_mode {
+ EDCCA_MODE_FORCE_DISABLE = 0,
+ EDCCA_MODE_AUTO = 1,
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index b5d105d..1c3f678 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -19,13 +19,6 @@
+ #include "dfs.h"
+ #include "crypto/crypto.h"
+
+-
+-enum dfs_channel_type {
+- DFS_ANY_CHANNEL,
+- DFS_AVAILABLE, /* non-radar or radar-available */
+- DFS_NO_CAC_YET, /* radar-not-yet-available */
+-};
+-
+ static struct hostapd_channel_data *
+ dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
+ u8 *oper_centr_freq_seg0_idx,
+@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
+ * - hapd->vht/he_oper_centr_freq_seg0_idx
+ * - hapd->vht/he_oper_centr_freq_seg1_idx
+ */
+-static int dfs_find_channel(struct hostapd_iface *iface,
+- struct hostapd_channel_data **ret_chan,
+- int idx, enum dfs_channel_type type)
++int dfs_find_channel(struct hostapd_iface *iface,
++ struct hostapd_channel_data **ret_chan,
++ int idx, enum dfs_channel_type type)
+ {
+ struct hostapd_hw_modes *mode;
+ struct hostapd_channel_data *chan;
+@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
+ }
+
+
+-static void dfs_adjust_center_freq(struct hostapd_iface *iface,
+- struct hostapd_channel_data *chan,
+- int secondary_channel,
+- int sec_chan_idx_80p80,
+- u8 *oper_centr_freq_seg0_idx,
+- u8 *oper_centr_freq_seg1_idx)
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++ struct hostapd_channel_data *chan,
++ int secondary_channel,
++ int sec_chan_idx_80p80,
++ u8 *oper_centr_freq_seg0_idx,
++ u8 *oper_centr_freq_seg1_idx)
+ {
+ if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
+ return;
+@@ -1317,6 +1310,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ __func__, iface->radar_background.cac_started ? "yes" : "no",
+ hostapd_csa_in_progress(iface) ? "yes" : "no");
+
++ /* Skip channel switch when background dfs detect mode is on */
++ if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
++ iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++ return 0;
++
+ /* Check if CSA in progress */
+ if (hostapd_csa_in_progress(iface))
+ return 0;
+@@ -1365,6 +1363,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
+ __func__, iface->cac_started ? "yes" : "no",
+ hostapd_csa_in_progress(iface) ? "yes" : "no");
+
++ /* Skip channel switch when dfs detect mode is on */
++ if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
++ iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++ return 0;
++
+ /* Check if CSA in progress */
+ if (hostapd_csa_in_progress(iface))
+ return 0;
+diff --git a/src/ap/dfs.h b/src/ap/dfs.h
+index 606c1b3..c2556d2 100644
+--- a/src/ap/dfs.h
++++ b/src/ap/dfs.h
+@@ -9,6 +9,12 @@
+ #ifndef DFS_H
+ #define DFS_H
+
++enum dfs_channel_type {
++ DFS_ANY_CHANNEL,
++ DFS_AVAILABLE, /* non-radar or radar-available */
++ DFS_NO_CAC_YET, /* radar-not-yet-available */
++};
++
+ int hostapd_handle_dfs(struct hostapd_iface *iface);
+
+ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+ int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
+ int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
+ int center_freq);
++int dfs_find_channel(struct hostapd_iface *iface,
++ struct hostapd_channel_data **ret_chan,
++ int idx, enum dfs_channel_type type);
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++ struct hostapd_channel_data *chan,
++ int secondary_channel,
++ int sec_chan_idx_80p80,
++ u8 *oper_centr_freq_seg0_idx,
++ u8 *oper_centr_freq_seg1_idx);
+
+ #endif /* DFS_H */
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index e44b73d..793ce2f 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -1463,7 +1463,9 @@ static int hostapd_setup_bss(struct hostapd_data *hapd, int first)
+ return -1;
+ }
+
+- if (!conf->start_disabled && ieee802_11_set_beacon(hapd) < 0)
++ if (conf->start_disabled)
++ hapd->driver->start_disabled(hapd->drv_priv);
++ else if (ieee802_11_set_beacon(hapd) < 0)
+ return -1;
+
+ if (flush_old_stations && !conf->start_disabled &&
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 71ded61..aa23fbd 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4720,6 +4720,13 @@ struct wpa_driver_ops {
+ *
+ */
+ int (*ibf_dump)(void *priv, u8 *ibf_enable);
++
++ /**
++ * start_disabled - set start_disabled to cfg80211
++ * @priv: Private driver interface data
++ *
++ */
++ int (*start_disabled)(void *priv);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index e974f85..003adc4 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12776,6 +12776,34 @@ fail:
+ return -ENOBUFS;
+ }
+
++static int nl80211_start_disabled(void *priv)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ msg = nl80211_bss_msg(bss, 0, NL80211_CMD_NEW_BEACON);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_flag(msg, NL80211_ATTR_START_DISABLED))
++ goto fail;
++
++ ret = send_and_recv_msgs_connect_handle(drv, msg, bss, 1);
++
++ if (ret)
++ wpa_printf(MSG_ERROR, "Failed to set start_disabled. ret=%d (%s)",
++ ret, strerror(-ret));
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return ret;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+ .desc = "Linux nl80211/cfg80211",
+@@ -12930,4 +12958,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .three_wire_ctrl = nl80211_enable_three_wire,
+ .ibf_ctrl = nl80211_ibf_enable,
+ .ibf_dump = nl80211_ibf_dump,
++ .start_disabled = nl80211_start_disabled,
+ };
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index c4bf3ad..79bc76c 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -3176,6 +3176,7 @@ enum nl80211_attrs {
+ NL80211_ATTR_EHT_CAPABILITY,
+
+ /* add attributes here, update the policy in nl80211.c */
++ NL80211_ATTR_START_DISABLED = 999,
+
+ __NL80211_ATTR_AFTER_LAST,
+ NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
+--
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches-2.11/patches.inc b/recipes-wifi/hostapd/files/patches-2.11/patches.inc
new file mode 100644
index 0000000..388c3d7
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.11/patches.inc
@@ -0,0 +1,66 @@
+#patch patches (come from openwrt/lede/target/linux/mediatek)
+SRC_URI_append = " \
+ file://001-wolfssl-init-RNG-with-ECC-key.patch \
+ file://010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch \
+ file://011-mesh-use-deterministic-channel-on-channel-switch.patch \
+ file://021-fix-sta-add-after-previous-connection.patch \
+ file://022-hostapd-fix-use-of-uninitialized-stack-variables.patch \
+ file://023-ndisc_snoop-call-dl_list_del-before-freeing-ipv6-add.patch \
+ file://030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch \
+ file://040-mesh-allow-processing-authentication-frames-in-block.patch \
+ file://050-build_fix.patch \
+ file://100-daemonize_fix.patch \
+ file://200-multicall.patch \
+ file://300-noscan.patch \
+ file://301-mesh-noscan.patch \
+ file://310-rescan_immediately.patch \
+ file://320-optional_rfkill.patch \
+ file://330-nl80211_fix_set_freq.patch \
+ file://340-reload_freq_change.patch \
+ file://341-mesh-ctrl-iface-channel-switch.patch \
+ file://350-nl80211_del_beacon_bss.patch \
+ file://360-ctrl_iface_reload.patch \
+ file://370-ap_sta_support.patch \
+ file://380-disable_ctrl_iface_mib.patch \
+ file://381-hostapd_cli_UNKNOWN-COMMAND.patch \
+ file://390-wpa_ie_cap_workaround.patch \
+ file://400-wps_single_auth_enc_type.patch \
+ file://410-limit_debug_messages.patch \
+ file://420-indicate-features.patch \
+ file://430-hostapd_cli_ifdef.patch \
+ file://431-wpa_cli_ifdef.patch \
+ file://432-missing-typedef.patch \
+ file://450-scan_wait.patch;apply=no \
+ file://460-wpa_supplicant-add-new-config-params-to-be-used-with.patch \
+ file://461-driver_nl80211-use-new-parameters-during-ibss-join.patch \
+ file://463-add-mcast_rate-to-11s.patch \
+ file://464-fix-mesh-obss-check.patch \
+ file://465-hostapd-config-support-random-BSS-color.patch \
+ file://470-survey_data_fallback.patch \
+ file://500-lto-jobserver-support.patch \
+ file://590-rrm-wnm-statistics.patch \
+ file://599-wpa_supplicant-fix-warnings.patch \
+ file://600-ubus_support.patch \
+ file://610-hostapd_cli_ujail_permission.patch \
+ file://700-wifi-reload.patch \
+ file://710-vlan_no_bridge.patch \
+ file://711-wds_bridge_force.patch \
+ file://720-iface_max_num_sta.patch \
+ file://730-ft_iface.patch \
+ file://740-snoop_iface.patch \
+ file://750-qos_map_set_without_interworking.patch \
+ file://751-qos_map_ignore_when_unsupported.patch \
+ file://800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch \
+ file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
+ file://992-openssl-include-rsa.patch \
+ file://99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch \
+ file://99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
+ file://99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch \
+ file://99903-hostapd-mtk-Add-mtk_vendor.h.patch \
+ file://99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch \
+ file://99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch \
+ file://99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch \
+ file://99907-hostapd-mtk-Add-hostapd-iBF-control.patch \
+ file://99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch \
+ file://99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch \
+ "
diff --git a/recipes-wifi/hostapd/hostapd_2.11.bb b/recipes-wifi/hostapd/hostapd_2.11.bb
new file mode 100644
index 0000000..fbe2e44
--- /dev/null
+++ b/recipes-wifi/hostapd/hostapd_2.11.bb
@@ -0,0 +1,112 @@
+SUMMARY = "User space daemon for extended IEEE 802.11 management"
+HOMEPAGE = "http://w1.fi/hostapd/"
+SECTION = "kernel/userland"
+LICENSE = "BSD-3-Clause"
+LIC_FILES_CHKSUM = "file://hostapd/README;md5=c905478466c90f1cefc0df987c40e172"
+
+DEPENDS = "libnl openssl ubus"
+DEPENDS_append = " ${@bb.utils.contains('DISTRO_FEATURES', 'telemetry2_0', 'telemetry', '', d)}"
+LDFLAGS_append = " ${@bb.utils.contains('DISTRO_FEATURES', 'telemetry2_0', ' -ltelemetry_msgsender ', '', d)}"
+RDEPENDS_${PN} += "gawk"
+
+FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
+FILESEXTRAPATHS_prepend := "${THISDIR}/files/patches-${PV}:"
+
+SRCREV ?= "b704dc72ef824dfdd96674b90179b274d1d38105"
+SRC_URI = " \
+ git://w1.fi/hostap.git;protocol=https;branch=main \
+ file://hostapd-full.config \
+ file://hostapd-2G.conf \
+ file://hostapd-5G.conf \
+ file://hostapd-6G.conf \
+ file://hostapd-5G-7915.conf \
+ file://hostapd-5G-7916.conf \
+ file://hostapd.service \
+ file://hostapd-init.sh \
+ file://mac80211.sh \
+ file://init-uci-config.service \
+ file://src \
+ file://001-rdkb-remove-ubus-support.patch;apply=no \
+"
+require files/patches-${PV}/patches.inc
+
+B = "${WORKDIR}/git/hostapd"
+S = "${WORKDIR}/git"
+
+inherit update-rc.d systemd pkgconfig features_check
+INITSCRIPT_NAME = "hostapd"
+
+SYSTEMD_AUTO_ENABLE_${PN} = "enable"
+SYSTEMD_SERVICE_${PN} = "hostapd.service"
+SYSTEMD_SERVICE_${PN} += " init-uci-config.service"
+
+do_unpack_append() {
+ bb.build.exec_func('do_copy_openwrt_src', d)
+}
+
+do_copy_openwrt_src() {
+ cp -Rfp ${WORKDIR}/src/* ${S}/
+}
+
+do_configure_append() {
+ install -m 0644 ${WORKDIR}/hostapd-full.config ${B}/.config
+
+ echo "CONFIG_MBO=y" >> ${B}/.config
+ echo "CONFIG_WPS_UPNP=y" >> ${B}/.config
+ echo "CONFIG_DPP=y" >> ${B}/.config
+ echo "CONFIG_DPP2=y" >> ${B}/.config
+ echo "CONFIG_DPP3=y" >> ${B}/.config
+
+ echo "CONFIG_ACS=y" >> ${B}/.config
+ echo "CONFIG_IEEE80211AX=y" >> ${B}/.config
+ echo "CONFIG_TLS=openssl" >> ${B}/.config
+ echo "CONFIG_SAE=y" >> ${B}/.config
+ echo "CONFIG_OWE=y" >> ${B}/.config
+ echo "CONFIG_SUITEB192=y" >> ${B}/.config
+ echo "CONFIG_AP=y" >> ${B}/.config
+ echo "CONFIG_MESH=y" >> ${B}/.config
+ echo "CONFIG_WEP=y" >> ${B}/.config
+ echo "CONFIG_FILS=y" >> ${B}/.config
+}
+
+do_filogic_patches() {
+ cd ${S}
+ if [ ! -e patch_applied ]; then
+ patch -p1 < ${WORKDIR}/001-rdkb-remove-ubus-support.patch
+ touch patch_applied
+ fi
+}
+
+addtask filogic_patches after do_patch before do_compile
+
+do_compile() {
+ export CFLAGS="-MMD -O2 -Wall -g -I${STAGING_INCDIR}/libnl3"
+ export EXTRA_CFLAGS="${CFLAGS}"
+ make V=1
+}
+
+do_install() {
+ install -d ${D}${sbindir} ${D}${sysconfdir} ${D}${systemd_unitdir}/system/ ${D}${base_libdir}/rdk
+ install -m 0755 ${B}/hostapd ${D}${sbindir}
+ install -m 0755 ${B}/hostapd_cli ${D}${sbindir}
+ install -m 0644 ${WORKDIR}/hostapd-2G.conf ${D}${sysconfdir}
+ install -m 0644 ${WORKDIR}/hostapd-5G.conf ${D}${sysconfdir}
+ install -m 0644 ${WORKDIR}/hostapd-6G.conf ${D}${sysconfdir}
+ install -m 0644 ${WORKDIR}/hostapd-5G-7915.conf ${D}${sysconfdir}
+ install -m 0644 ${WORKDIR}/hostapd-5G-7916.conf ${D}${sysconfdir}
+ install -m 0644 ${WORKDIR}/hostapd.service ${D}${systemd_unitdir}/system
+ install -m 0755 ${WORKDIR}/hostapd-init.sh ${D}${base_libdir}/rdk
+ install -m 0644 ${WORKDIR}/init-uci-config.service ${D}${systemd_unitdir}/system
+ install -m 0755 ${WORKDIR}/mac80211.sh ${D}${sbindir}
+}
+
+FILES_${PN} += " \
+ ${systemd_unitdir}/system/hostapd.service \
+ ${sysconfdir}/hostapd-2G.conf \
+ ${sysconfdir}/hostapd-5G.conf \
+ ${sysconfdir}/hostapd-6G.conf \
+ ${sysconfdir}/hostapd-5G-7915.conf \
+ ${sysconfdir}/hostapd-5G-7916.conf \
+ ${base_libdir}/rdk/hostapd-init.sh \
+ ${systemd_unitdir}/system/init-uci-config.service \
+"
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/000-fix_kconfig.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/000-fix_kconfig.patch
new file mode 100644
index 0000000..3987aae
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/000-fix_kconfig.patch
@@ -0,0 +1,14 @@
+--- a/kconf/Makefile
++++ b/kconf/Makefile
+@@ -1,9 +1,9 @@
+-CFLAGS=-Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
++CFLAGS=-Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -DKBUILD_NO_NLS
+
+ LXDIALOG := lxdialog/checklist.o lxdialog/inputbox.o lxdialog/menubox.o lxdialog/textbox.o lxdialog/util.o lxdialog/yesno.o
+
+ conf: conf.o zconf.tab.o
+-mconf_CFLAGS := $(shell ./lxdialog/check-lxdialog.sh -ccflags) -DLOCALE
++mconf_CFLAGS := $(shell ./lxdialog/check-lxdialog.sh -ccflags)
+ mconf_LDFLAGS := $(shell ./lxdialog/check-lxdialog.sh -ldflags $(CC))
+ mconf: CFLAGS += $(mconf_CFLAGS)
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/001-fix_build.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/001-fix_build.patch
new file mode 100644
index 0000000..8f63d36
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/001-fix_build.patch
@@ -0,0 +1,169 @@
+--- a/Makefile
++++ b/Makefile
+@@ -5,7 +5,7 @@
+ ifeq ($(KERNELRELEASE),)
+
+ MAKEFLAGS += --no-print-directory
+-SHELL := /bin/bash
++SHELL := /usr/bin/env bash
+ BACKPORT_DIR := $(shell pwd)
+
+ KMODDIR ?= updates
+@@ -19,6 +19,7 @@ KLIB_BUILD ?= $(KLIB)/build/
+ KERNEL_CONFIG := $(KLIB_BUILD)/.config
+ KERNEL_MAKEFILE := $(KLIB_BUILD)/Makefile
+ CONFIG_MD5 := $(shell md5sum $(KERNEL_CONFIG) 2>/dev/null | sed 's/\s.*//')
++STAMP_KERNEL_CONFIG := .kernel_config_md5_$(CONFIG_MD5)
+
+ export KLIB KLIB_BUILD BACKPORT_DIR KMODDIR KMODPATH_ARG
+
+@@ -36,7 +37,8 @@ mrproper:
+ @rm -f .kernel_config_md5 Kconfig.versions Kconfig.kernel
+ @rm -f backport-include/backport/autoconf.h
+
+-.DEFAULT:
++.SILENT: $(STAMP_KERNEL_CONFIG)
++$(STAMP_KERNEL_CONFIG):
+ @set -e ; test -f local-symbols || ( \
+ echo "/--------------" ;\
+ echo "| You shouldn't run make in the backports tree, but only in" ;\
+@@ -60,58 +62,62 @@ mrproper:
+ echo "| (that isn't currently running.)" ;\
+ echo "\\--" ;\
+ false)
+- @set -e ; if [ "$$(cat .kernel_config_md5 2>/dev/null)" != "$(CONFIG_MD5)" ] ;\
+- then \
+- echo -n "Generating local configuration database from kernel ..." ;\
+- grep -v -f local-symbols $(KERNEL_CONFIG) | grep = | ( \
+- while read l ; do \
+- if [ "$${l:0:7}" != "CONFIG_" ] ; then \
+- continue ;\
+- fi ;\
+- l=$${l:7} ;\
+- n=$${l%%=*} ;\
+- v=$${l#*=} ;\
+- if [ "$$v" = "m" ] ; then \
+- echo config $$n ;\
+- echo ' tristate' ;\
+- elif [ "$$v" = "y" ] ; then \
+- echo config $$n ;\
+- echo ' bool' ;\
+- else \
+- continue ;\
+- fi ;\
+- echo " default $$v" ;\
+- echo "" ;\
+- done \
+- ) > Kconfig.kernel ;\
+- kver=$$($(MAKE) --no-print-directory -C $(KLIB_BUILD) M=$(BACKPORT_DIR) \
+- kernelversion | sed 's/^\(\([3-5]\|2\.6\)\.[0-9]\+\).*/\1/;t;d');\
+- test "$$kver" != "" || echo "Kernel version parse failed!" ;\
+- test "$$kver" != "" ;\
+- kvers="$$(seq 14 39 | sed 's/^/2.6./')" ;\
+- kvers="$$kvers $$(seq 0 19 | sed 's/^/3./')" ;\
+- kvers="$$kvers $$(seq 0 20 | sed 's/^/4./')" ;\
+- kvers="$$kvers $$(seq 0 99 | sed 's/^/5./')" ;\
+- print=0 ;\
+- for v in $$kvers ; do \
+- if [ "$$print" = "1" ] ; then \
+- echo config KERNEL_$$(echo $$v | tr . _) ;\
+- echo " def_bool y" ;\
+- fi ;\
+- if [ "$$v" = "$$kver" ] ; then print=1 ; fi ;\
+- done > Kconfig.versions ;\
+- # RHEL as well, sadly we need to grep for it ;\
+- RHEL_MAJOR=$$(grep '^RHEL_MAJOR' $(KERNEL_MAKEFILE) | \
+- sed 's/.*=\s*\([0-9]*\)/\1/;t;d') ;\
+- RHEL_MINOR=$$(grep '^RHEL_MINOR' $(KERNEL_MAKEFILE) | \
+- sed 's/.*=\s*\([0-9]*\)/\1/;t;d') ;\
+- for v in $$(seq 0 $$RHEL_MINOR) ; do \
+- echo config BACKPORT_RHEL_KERNEL_$${RHEL_MAJOR}_$$v ;\
+- echo " def_bool y" ;\
+- done >> Kconfig.versions ;\
+- echo " done." ;\
+- fi ;\
+- echo "$(CONFIG_MD5)" > .kernel_config_md5
++ @rm -f .kernel_config_md5_*
++ @touch $@
++
++Kconfig.kernel: $(STAMP_KERNEL_CONFIG) local-symbols
++ @printf "Generating local configuration database from kernel ..."
++ @grep -v -f local-symbols $(KERNEL_CONFIG) | grep = | ( \
++ while read l ; do \
++ if [ "$${l:0:7}" != "CONFIG_" ] ; then \
++ continue ;\
++ fi ;\
++ l=$${l:7} ;\
++ n=$${l%%=*} ;\
++ v=$${l#*=} ;\
++ if [ "$$v" = "m" ] ; then \
++ echo config $$n ;\
++ echo ' tristate' ;\
++ elif [ "$$v" = "y" ] ; then \
++ echo config $$n ;\
++ echo ' bool' ;\
++ else \
++ continue ;\
++ fi ;\
++ echo " default $$v" ;\
++ echo "" ;\
++ done \
++ ) > $@
++ @echo " done."
++
++Kconfig.versions: Kconfig.kernel
++ @kver=$$($(MAKE) --no-print-directory -C $(KLIB_BUILD) M=$(BACKPORT_DIR) \
++ kernelversion | sed 's/^\(\([3-5]\|2\.6\)\.[0-9]\+\).*/\1/;t;d');\
++ test "$$kver" != "" || echo "Kernel version parse failed!" ;\
++ test "$$kver" != "" ;\
++ kvers="$$(seq 14 39 | sed 's/^/2.6./')" ;\
++ kvers="$$kvers $$(seq 0 19 | sed 's/^/3./')" ;\
++ kvers="$$kvers $$(seq 0 20 | sed 's/^/4./')" ;\
++ kvers="$$kvers $$(seq 0 99 | sed 's/^/5./')" ;\
++ print=0 ;\
++ for v in $$kvers ; do \
++ if [ "$$print" = "1" ] ; then \
++ echo config KERNEL_$$(echo $$v | tr . _) ;\
++ echo " def_bool y" ;\
++ fi ;\
++ if [ "$$v" = "$$kver" ] ; then print=1 ; fi ;\
++ done > $@
++ @RHEL_MAJOR=$$(grep '^RHEL_MAJOR' $(KERNEL_MAKEFILE) | \
++ sed 's/.*=\s*\([0-9]*\)/\1/;t;d') ;\
++ RHEL_MINOR=$$(grep '^RHEL_MINOR' $(KERNEL_MAKEFILE) | \
++ sed 's/.*=\s*\([0-9]*\)/\1/;t;d') ;\
++ for v in $$(seq 0 $$RHEL_MINOR) ; do \
++ echo config BACKPORT_RHEL_KERNEL_$${RHEL_MAJOR}_$$v ;\
++ echo " def_bool y" ;\
++ done >> $@
++
++.DEFAULT:
++ @$(MAKE) Kconfig.versions
+ @$(MAKE) -f Makefile.real "$@"
+
+ .PHONY: defconfig-help
+--- a/Makefile.real
++++ b/Makefile.real
+@@ -59,7 +59,7 @@ defconfig-%::
+
+ backport-include/backport/autoconf.h: .config Kconfig.versions Kconfig.kernel
+ @$(MAKE) oldconfig
+- @echo -n "Building backport-include/backport/autoconf.h ..."
++ @printf "Building backport-include/backport/autoconf.h ..."
+ @grep -f local-symbols .config | ( \
+ echo "#ifndef COMPAT_AUTOCONF_INCLUDED" ;\
+ echo "#define COMPAT_AUTOCONF_INCLUDED" ;\
+@@ -80,7 +80,12 @@ backport-include/backport/autoconf.h: .c
+ esac ;\
+ done ;\
+ echo "#endif /* COMPAT_AUTOCONF_INCLUDED */" ;\
+- ) > backport-include/backport/autoconf.h
++ ) > $@.new
++ @if cmp -s $@ $@.new; then \
++ rm -f $@.new; \
++ else \
++ mv $@.new $@; \
++ fi
+ @echo " done."
+
+ .PHONY: modules
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/002-change_allconfig.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/002-change_allconfig.patch
new file mode 100644
index 0000000..368725d
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/002-change_allconfig.patch
@@ -0,0 +1,64 @@
+--- a/kconf/conf.c
++++ b/kconf/conf.c
+@@ -598,40 +598,12 @@ int main(int ac, char **av)
+ case oldconfig:
+ case listnewconfig:
+ case olddefconfig:
+- conf_read(NULL);
+- break;
+ case allnoconfig:
+ case allyesconfig:
+ case allmodconfig:
+ case alldefconfig:
+ case randconfig:
+- name = getenv("KCONFIG_ALLCONFIG");
+- if (!name)
+- break;
+- if ((strcmp(name, "") != 0) && (strcmp(name, "1") != 0)) {
+- if (conf_read_simple(name, S_DEF_USER)) {
+- fprintf(stderr,
+- _("*** Can't read seed configuration \"%s\"!\n"),
+- name);
+- exit(1);
+- }
+- break;
+- }
+- switch (input_mode) {
+- case allnoconfig: name = "allno.config"; break;
+- case allyesconfig: name = "allyes.config"; break;
+- case allmodconfig: name = "allmod.config"; break;
+- case alldefconfig: name = "alldef.config"; break;
+- case randconfig: name = "allrandom.config"; break;
+- default: break;
+- }
+- if (conf_read_simple(name, S_DEF_USER) &&
+- conf_read_simple("all.config", S_DEF_USER)) {
+- fprintf(stderr,
+- _("*** KCONFIG_ALLCONFIG set, but no \"%s\" or \"all.config\" file found\n"),
+- name);
+- exit(1);
+- }
++ conf_read(NULL);
+ break;
+ default:
+ break;
+--- a/kconf/confdata.c
++++ b/kconf/confdata.c
+@@ -1170,6 +1170,8 @@ bool conf_set_all_new_symbols(enum conf_
+ }
+ bool has_changed = false;
+
++ sym_clear_all_valid();
++
+ for_all_symbols(i, sym) {
+ if (sym_has_value(sym) || (sym->flags & SYMBOL_VALID))
+ continue;
+@@ -1213,8 +1215,6 @@ bool conf_set_all_new_symbols(enum conf_
+
+ }
+
+- sym_clear_all_valid();
+-
+ /*
+ * We have different type of choice blocks.
+ * If curr.tri equals to mod then we can select several
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/003-remove_bogus_modparams.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/003-remove_bogus_modparams.patch
new file mode 100644
index 0000000..aa26c8c
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/003-remove_bogus_modparams.patch
@@ -0,0 +1,34 @@
+--- a/compat/main.c
++++ b/compat/main.c
+@@ -19,31 +19,6 @@ MODULE_LICENSE("GPL");
+ #error "You need a CPTCFG_VERSION"
+ #endif
+
+-static char *backported_kernel_name = CPTCFG_KERNEL_NAME;
+-
+-module_param(backported_kernel_name, charp, 0400);
+-MODULE_PARM_DESC(backported_kernel_name,
+- "The kernel tree name that was used for this backport (" CPTCFG_KERNEL_NAME ")");
+-
+-#ifdef BACKPORTS_GIT_TRACKED
+-static char *backports_tracker_id = BACKPORTS_GIT_TRACKED;
+-module_param(backports_tracker_id, charp, 0400);
+-MODULE_PARM_DESC(backports_tracker_id,
+- "The version of the tree containing this backport (" BACKPORTS_GIT_TRACKED ")");
+-#else
+-static char *backported_kernel_version = CPTCFG_KERNEL_VERSION;
+-static char *backports_version = CPTCFG_VERSION;
+-
+-module_param(backported_kernel_version, charp, 0400);
+-MODULE_PARM_DESC(backported_kernel_version,
+- "The kernel version that was used for this backport (" CPTCFG_KERNEL_VERSION ")");
+-
+-module_param(backports_version, charp, 0400);
+-MODULE_PARM_DESC(backports_version,
+- "The git version of the backports tree used to generate this backport (" CPTCFG_VERSION ")");
+-
+-#endif
+-
+ void backport_dependency_symbol(void)
+ {
+ }
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/012-kernel_build_check.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/012-kernel_build_check.patch
new file mode 100644
index 0000000..d225ba1
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/012-kernel_build_check.patch
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -2,7 +2,7 @@
+ # Makefile for the output source package
+ #
+
+-ifeq ($(KERNELRELEASE),)
++ifeq ($(KERNELVERSION),)
+
+ MAKEFLAGS += --no-print-directory
+ SHELL := /usr/bin/env bash
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/015-ipw200-mtu.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/015-ipw200-mtu.patch
new file mode 100644
index 0000000..68db4f7
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/015-ipw200-mtu.patch
@@ -0,0 +1,34 @@
+--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+@@ -11470,6 +11470,15 @@ static const struct attribute_group ipw_
+ .attrs = ipw_sysfs_entries,
+ };
+
++#if LINUX_VERSION_IS_LESS(4,10,0)
++static int __change_mtu(struct net_device *ndev, int new_mtu){
++ if (new_mtu < 68 || new_mtu > LIBIPW_DATA_LEN)
++ return -EINVAL;
++ ndev->mtu = new_mtu;
++ return 0;
++}
++#endif
++
+ #ifdef CPTCFG_IPW2200_PROMISCUOUS
+ static int ipw_prom_open(struct net_device *dev)
+ {
+@@ -11518,15 +11527,6 @@ static netdev_tx_t ipw_prom_hard_start_x
+ return NETDEV_TX_OK;
+ }
+
+-#if LINUX_VERSION_IS_LESS(4,10,0)
+-static int __change_mtu(struct net_device *ndev, int new_mtu){
+- if (new_mtu < 68 || new_mtu > LIBIPW_DATA_LEN)
+- return -EINVAL;
+- ndev->mtu = new_mtu;
+- return 0;
+-}
+-#endif
+-
+ static const struct net_device_ops ipw_prom_netdev_ops = {
+ #if LINUX_VERSION_IS_LESS(4,10,0)
+ .ndo_change_mtu = __change_mtu,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/050-lib80211_option.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/050-lib80211_option.patch
new file mode 100644
index 0000000..c1b1bc7
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/050-lib80211_option.patch
@@ -0,0 +1,34 @@
+--- a/net/wireless/Kconfig
++++ b/net/wireless/Kconfig
+@@ -188,7 +188,7 @@ config CFG80211_WEXT_EXPORT
+ endif # CFG80211
+
+ config LIB80211
+- tristate
++ tristate "lib80211"
+ depends on m
+ default n
+ help
+@@ -198,19 +198,19 @@ config LIB80211
+ Drivers should select this themselves if needed.
+
+ config LIB80211_CRYPT_WEP
+- tristate
++ tristate "lib80211 WEP support"
+ depends on m
+ select BPAUTO_CRYPTO_LIB_ARC4
+
+ config LIB80211_CRYPT_CCMP
+- tristate
++ tristate "lib80211 CCMP support"
+ depends on m
+ depends on CRYPTO
+ depends on CRYPTO_AES
+ depends on CRYPTO_CCM
+
+ config LIB80211_CRYPT_TKIP
+- tristate
++ tristate "lib80211 TKIP support"
+ depends on m
+ select BPAUTO_CRYPTO_LIB_ARC4
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/060-no_local_ssb_bcma.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/060-no_local_ssb_bcma.patch
new file mode 100644
index 0000000..089ff21
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/060-no_local_ssb_bcma.patch
@@ -0,0 +1,335 @@
+--- a/local-symbols
++++ b/local-symbols
+@@ -451,43 +451,6 @@ USB_VL600=
+ USB_NET_CH9200=
+ USB_NET_AQC111=
+ USB_RTL8153_ECM=
+-SSB_POSSIBLE=
+-SSB=
+-SSB_SPROM=
+-SSB_BLOCKIO=
+-SSB_PCIHOST_POSSIBLE=
+-SSB_PCIHOST=
+-SSB_B43_PCI_BRIDGE=
+-SSB_PCMCIAHOST_POSSIBLE=
+-SSB_PCMCIAHOST=
+-SSB_SDIOHOST_POSSIBLE=
+-SSB_SDIOHOST=
+-SSB_HOST_SOC=
+-SSB_SERIAL=
+-SSB_DRIVER_PCICORE_POSSIBLE=
+-SSB_DRIVER_PCICORE=
+-SSB_PCICORE_HOSTMODE=
+-SSB_DRIVER_MIPS=
+-SSB_SFLASH=
+-SSB_EMBEDDED=
+-SSB_DRIVER_EXTIF=
+-SSB_DRIVER_GIGE=
+-SSB_DRIVER_GPIO=
+-BCMA_POSSIBLE=
+-BCMA=
+-BCMA_BLOCKIO=
+-BCMA_HOST_PCI_POSSIBLE=
+-BCMA_HOST_PCI=
+-BCMA_HOST_SOC=
+-BCMA_DRIVER_PCI=
+-BCMA_DRIVER_PCI_HOSTMODE=
+-BCMA_DRIVER_MIPS=
+-BCMA_PFLASH=
+-BCMA_SFLASH=
+-BCMA_NFLASH=
+-BCMA_DRIVER_GMAC_CMN=
+-BCMA_DRIVER_GPIO=
+-BCMA_DEBUG=
+ USB_ACM=
+ USB_PRINTER=
+ USB_WDM=
+--- a/drivers/net/wireless/broadcom/b43/Kconfig
++++ b/drivers/net/wireless/broadcom/b43/Kconfig
+@@ -63,21 +63,21 @@ endchoice
+ config B43_PCI_AUTOSELECT
+ bool
+ depends on B43 && SSB_PCIHOST_POSSIBLE
+- select SSB_PCIHOST
+- select SSB_B43_PCI_BRIDGE
++ depends on SSB_PCIHOST
++ depends on SSB_B43_PCI_BRIDGE
+ default y
+
+ # Auto-select SSB PCICORE driver, if possible
+ config B43_PCICORE_AUTOSELECT
+ bool
+ depends on B43 && SSB_DRIVER_PCICORE_POSSIBLE
+- select SSB_DRIVER_PCICORE
++ depends on SSB_DRIVER_PCICORE
+ default y
+
+ config B43_SDIO
+ bool "Broadcom 43xx SDIO device support"
+ depends on B43 && B43_SSB && SSB_SDIOHOST_POSSIBLE
+- select SSB_SDIOHOST
++ depends on SSB_SDIOHOST
+ help
+ Broadcom 43xx device support for Soft-MAC SDIO devices.
+
+@@ -96,13 +96,13 @@ config B43_SDIO
+ config B43_BCMA_PIO
+ bool
+ depends on B43 && B43_BCMA
+- select BCMA_BLOCKIO
++ depends on BCMA_BLOCKIO
+ default y
+
+ config B43_PIO
+ bool
+ depends on B43 && B43_SSB
+- select SSB_BLOCKIO
++ depends on SSB_BLOCKIO
+ default y
+
+ config B43_PHY_G
+--- a/drivers/net/wireless/broadcom/b43/main.c
++++ b/drivers/net/wireless/broadcom/b43/main.c
+@@ -2853,7 +2853,7 @@ static struct ssb_device *b43_ssb_gpio_d
+ {
+ struct ssb_bus *bus = dev->dev->sdev->bus;
+
+-#ifdef CPTCFG_SSB_DRIVER_PCICORE
++#ifdef CONFIG_SSB_DRIVER_PCICORE
+ return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
+ #else
+ return bus->chipco.dev;
+@@ -4870,7 +4870,7 @@ static int b43_wireless_core_init(struct
+ }
+ if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
+ hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
+-#if defined(CPTCFG_B43_SSB) && defined(CPTCFG_SSB_DRIVER_PCICORE)
++#if defined(CPTCFG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
+ if (dev->dev->bus_type == B43_BUS_SSB &&
+ dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
+ dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
+--- a/drivers/net/wireless/broadcom/b43legacy/Kconfig
++++ b/drivers/net/wireless/broadcom/b43legacy/Kconfig
+@@ -3,7 +3,7 @@ config B43LEGACY
+ tristate "Broadcom 43xx-legacy wireless support (mac80211 stack)"
+ depends on m
+ depends on SSB_POSSIBLE && MAC80211 && HAS_DMA
+- select SSB
++ depends on SSB
+ depends on FW_LOADER
+ help
+ b43legacy is a driver for 802.11b devices from Broadcom (BCM4301 and
+@@ -25,15 +25,15 @@ config B43LEGACY
+ config B43LEGACY_PCI_AUTOSELECT
+ bool
+ depends on B43LEGACY && SSB_PCIHOST_POSSIBLE
+- select SSB_PCIHOST
+- select SSB_B43_PCI_BRIDGE
++ depends on SSB_PCIHOST
++ depends on SSB_B43_PCI_BRIDGE
+ default y
+
+ # Auto-select SSB PCICORE driver, if possible
+ config B43LEGACY_PCICORE_AUTOSELECT
+ bool
+ depends on B43LEGACY && SSB_DRIVER_PCICORE_POSSIBLE
+- select SSB_DRIVER_PCICORE
++ depends on SSB_DRIVER_PCICORE
+ default y
+
+ # LED support
+--- a/drivers/net/wireless/broadcom/b43legacy/main.c
++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
+@@ -1907,7 +1907,7 @@ static int b43legacy_gpio_init(struct b4
+ if (dev->dev->id.revision >= 2)
+ mask |= 0x0010; /* FIXME: This is redundant. */
+
+-#ifdef CPTCFG_SSB_DRIVER_PCICORE
++#ifdef CONFIG_SSB_DRIVER_PCICORE
+ pcidev = bus->pcicore.dev;
+ #endif
+ gpiodev = bus->chipco.dev ? : pcidev;
+@@ -1926,7 +1926,7 @@ static void b43legacy_gpio_cleanup(struc
+ struct ssb_bus *bus = dev->dev->bus;
+ struct ssb_device *gpiodev, *pcidev = NULL;
+
+-#ifdef CPTCFG_SSB_DRIVER_PCICORE
++#ifdef CONFIG_SSB_DRIVER_PCICORE
+ pcidev = bus->pcicore.dev;
+ #endif
+ gpiodev = bus->chipco.dev ? : pcidev;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
+@@ -24,7 +24,7 @@ struct brcms_led {
+ struct gpio_desc *gpiod;
+ };
+
+-#ifdef CPTCFG_BCMA_DRIVER_GPIO
++#ifdef CONFIG_BCMA_DRIVER_GPIO
+ void brcms_led_unregister(struct brcms_info *wl);
+ int brcms_led_register(struct brcms_info *wl);
+ #else
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
+@@ -42,6 +42,6 @@ brcmsmac-y := \
+ brcms_trace_events.o \
+ debug.o
+
+-brcmsmac-$(CPTCFG_BCMA_DRIVER_GPIO) += led.o
++brcmsmac-$(CONFIG_BCMA_DRIVER_GPIO) += led.o
+
+ obj-$(CPTCFG_BRCMSMAC) += brcmsmac.o
+--- a/drivers/net/wireless/broadcom/brcm80211/Kconfig
++++ b/drivers/net/wireless/broadcom/brcm80211/Kconfig
+@@ -8,7 +8,7 @@ config BRCMSMAC
+ depends on m
+ depends on MAC80211
+ depends on BCMA_POSSIBLE
+- select BCMA
++ depends on BCMA
+ select NEW_LEDS if BCMA_DRIVER_GPIO
+ select LEDS_CLASS if BCMA_DRIVER_GPIO
+ select BRCMUTIL
+--- a/Kconfig.local
++++ b/Kconfig.local
+@@ -1357,117 +1357,6 @@ config BACKPORTED_USB_NET_AQC111
+ config BACKPORTED_USB_RTL8153_ECM
+ tristate
+ default USB_RTL8153_ECM
+-config BACKPORTED_SSB_POSSIBLE
+- tristate
+- default SSB_POSSIBLE
+-config BACKPORTED_SSB
+- tristate
+- default SSB
+-config BACKPORTED_SSB_SPROM
+- tristate
+- default SSB_SPROM
+-config BACKPORTED_SSB_BLOCKIO
+- tristate
+- default SSB_BLOCKIO
+-config BACKPORTED_SSB_PCIHOST_POSSIBLE
+- tristate
+- default SSB_PCIHOST_POSSIBLE
+-config BACKPORTED_SSB_PCIHOST
+- tristate
+- default SSB_PCIHOST
+-config BACKPORTED_SSB_B43_PCI_BRIDGE
+- tristate
+- default SSB_B43_PCI_BRIDGE
+-config BACKPORTED_SSB_PCMCIAHOST_POSSIBLE
+- tristate
+- default SSB_PCMCIAHOST_POSSIBLE
+-config BACKPORTED_SSB_PCMCIAHOST
+- tristate
+- default SSB_PCMCIAHOST
+-config BACKPORTED_SSB_SDIOHOST_POSSIBLE
+- tristate
+- default SSB_SDIOHOST_POSSIBLE
+-config BACKPORTED_SSB_SDIOHOST
+- tristate
+- default SSB_SDIOHOST
+-config BACKPORTED_SSB_HOST_SOC
+- tristate
+- default SSB_HOST_SOC
+-config BACKPORTED_SSB_SERIAL
+- tristate
+- default SSB_SERIAL
+-config BACKPORTED_SSB_DRIVER_PCICORE_POSSIBLE
+- tristate
+- default SSB_DRIVER_PCICORE_POSSIBLE
+-config BACKPORTED_SSB_DRIVER_PCICORE
+- tristate
+- default SSB_DRIVER_PCICORE
+-config BACKPORTED_SSB_PCICORE_HOSTMODE
+- tristate
+- default SSB_PCICORE_HOSTMODE
+-config BACKPORTED_SSB_DRIVER_MIPS
+- tristate
+- default SSB_DRIVER_MIPS
+-config BACKPORTED_SSB_SFLASH
+- tristate
+- default SSB_SFLASH
+-config BACKPORTED_SSB_EMBEDDED
+- tristate
+- default SSB_EMBEDDED
+-config BACKPORTED_SSB_DRIVER_EXTIF
+- tristate
+- default SSB_DRIVER_EXTIF
+-config BACKPORTED_SSB_DRIVER_GIGE
+- tristate
+- default SSB_DRIVER_GIGE
+-config BACKPORTED_SSB_DRIVER_GPIO
+- tristate
+- default SSB_DRIVER_GPIO
+-config BACKPORTED_BCMA_POSSIBLE
+- tristate
+- default BCMA_POSSIBLE
+-config BACKPORTED_BCMA
+- tristate
+- default BCMA
+-config BACKPORTED_BCMA_BLOCKIO
+- tristate
+- default BCMA_BLOCKIO
+-config BACKPORTED_BCMA_HOST_PCI_POSSIBLE
+- tristate
+- default BCMA_HOST_PCI_POSSIBLE
+-config BACKPORTED_BCMA_HOST_PCI
+- tristate
+- default BCMA_HOST_PCI
+-config BACKPORTED_BCMA_HOST_SOC
+- tristate
+- default BCMA_HOST_SOC
+-config BACKPORTED_BCMA_DRIVER_PCI
+- tristate
+- default BCMA_DRIVER_PCI
+-config BACKPORTED_BCMA_DRIVER_PCI_HOSTMODE
+- tristate
+- default BCMA_DRIVER_PCI_HOSTMODE
+-config BACKPORTED_BCMA_DRIVER_MIPS
+- tristate
+- default BCMA_DRIVER_MIPS
+-config BACKPORTED_BCMA_PFLASH
+- tristate
+- default BCMA_PFLASH
+-config BACKPORTED_BCMA_SFLASH
+- tristate
+- default BCMA_SFLASH
+-config BACKPORTED_BCMA_NFLASH
+- tristate
+- default BCMA_NFLASH
+-config BACKPORTED_BCMA_DRIVER_GMAC_CMN
+- tristate
+- default BCMA_DRIVER_GMAC_CMN
+-config BACKPORTED_BCMA_DRIVER_GPIO
+- tristate
+- default BCMA_DRIVER_GPIO
+-config BACKPORTED_BCMA_DEBUG
+- tristate
+- default BCMA_DEBUG
+ config BACKPORTED_USB_ACM
+ tristate
+ default USB_ACM
+--- a/Kconfig.sources
++++ b/Kconfig.sources
+@@ -10,9 +10,6 @@ source "$BACKPORT_DIR/drivers/soc/qcom/K
+ source "$BACKPORT_DIR/drivers/net/wireless/Kconfig"
+ source "$BACKPORT_DIR/drivers/net/usb/Kconfig"
+
+-source "$BACKPORT_DIR/drivers/ssb/Kconfig"
+-source "$BACKPORT_DIR/drivers/bcma/Kconfig"
+-
+ source "$BACKPORT_DIR/drivers/usb/class/Kconfig"
+
+ source "$BACKPORT_DIR/drivers/staging/Kconfig"
+--- a/Makefile.kernel
++++ b/Makefile.kernel
+@@ -43,8 +43,6 @@ obj-$(CPTCFG_QRTR) += net/qrtr/
+ obj-$(CPTCFG_QCOM_QMI_HELPERS) += drivers/soc/qcom/
+ obj-$(CPTCFG_MHI_BUS) += drivers/bus/mhi/
+ obj-$(CPTCFG_WLAN) += drivers/net/wireless/
+-obj-$(CPTCFG_SSB) += drivers/ssb/
+-obj-$(CPTCFG_BCMA) += drivers/bcma/
+ obj-$(CPTCFG_USB_NET_RNDIS_WLAN) += drivers/net/usb/
+
+ obj-$(CPTCFG_USB_WDM) += drivers/usb/class/
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/070-remove-broken-wext-select.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/070-remove-broken-wext-select.patch
new file mode 100644
index 0000000..77b6e1d
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/070-remove-broken-wext-select.patch
@@ -0,0 +1,10 @@
+--- a/drivers/staging/rtl8723bs/Kconfig
++++ b/drivers/staging/rtl8723bs/Kconfig
+@@ -5,7 +5,6 @@ config RTL8723BS
+ depends on m
+ depends on WLAN && MMC && CFG80211
+ depends on m
+- select CFG80211_WEXT
+ select BPAUTO_CRYPTO_LIB_ARC4
+ help
+ This option enables support for RTL8723BS SDIO drivers, such as
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc b/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc
new file mode 100644
index 0000000..a50f5cd
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc
@@ -0,0 +1,12 @@
+#patch build (come from openwrt/lede/target/linux/mediatek)
+SRC_URI_append = " \
+ file://000-fix_kconfig.patch \
+ file://001-fix_build.patch \
+ file://002-change_allconfig.patch \
+ file://003-remove_bogus_modparams.patch \
+ file://012-kernel_build_check.patch \
+ file://015-ipw200-mtu.patch \
+ file://050-lib80211_option.patch \
+ file://060-no_local_ssb_bcma.patch \
+ file://070-remove-broken-wext-select.patch \
+ "
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/110-mac80211_keep_keys_on_stop_ap.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/110-mac80211_keep_keys_on_stop_ap.patch
new file mode 100644
index 0000000..397026b
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/110-mac80211_keep_keys_on_stop_ap.patch
@@ -0,0 +1,19 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 27 Oct 2014 00:00:00 +0100
+Subject: [PATCH] mac80211: preseve AP mode keys across STA reconnect
+
+Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnect
+---
+ net/mac80211/cfg.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1319,7 +1319,6 @@ static int ieee80211_stop_ap(struct wiph
+ sdata->vif.bss_conf.ftmr_params = NULL;
+
+ __sta_info_flush(sdata, true);
+- ieee80211_free_keys(sdata, true);
+
+ sdata->vif.bss_conf.enable_beacon = false;
+ sdata->beacon_rate_set = false;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/120-cfg80211_allow_perm_addr_change.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/120-cfg80211_allow_perm_addr_change.patch
new file mode 100644
index 0000000..f315ae5
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/120-cfg80211_allow_perm_addr_change.patch
@@ -0,0 +1,52 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 11 Dec 2014 00:00:00 +0100
+Subject: [PATCH] cfg80211: add support for changing the device mac address via
+ sysfs
+
+---
+ net/wireless/sysfs.c | 27 ++++++++++++++++++++++-----
+ 1 file changed, 22 insertions(+), 5 deletions(-)
+
+--- a/net/wireless/sysfs.c
++++ b/net/wireless/sysfs.c
+@@ -24,18 +24,35 @@ static inline struct cfg80211_registered
+ return container_of(dev, struct cfg80211_registered_device, wiphy.dev);
+ }
+
+-#define SHOW_FMT(name, fmt, member) \
++#define SHOW_FMT(name, fmt, member, mode) \
+ static ssize_t name ## _show(struct device *dev, \
+ struct device_attribute *attr, \
+ char *buf) \
+ { \
+ return sprintf(buf, fmt "\n", dev_to_rdev(dev)->member); \
+ } \
+-static DEVICE_ATTR_RO(name)
++static DEVICE_ATTR_##mode(name)
+
+-SHOW_FMT(index, "%d", wiphy_idx);
+-SHOW_FMT(macaddress, "%pM", wiphy.perm_addr);
+-SHOW_FMT(address_mask, "%pM", wiphy.addr_mask);
++static ssize_t macaddress_store(struct device *dev,
++ struct device_attribute *attr,
++ const char *buf, size_t len)
++{
++ u8 mac[ETH_ALEN];
++
++ if (!mac_pton(buf, mac))
++ return -EINVAL;
++
++ if (buf[3 * ETH_ALEN - 1] && buf[3 * ETH_ALEN - 1] != '\n')
++ return -EINVAL;
++
++ memcpy(dev_to_rdev(dev)->wiphy.perm_addr, mac, ETH_ALEN);
++
++ return strnlen(buf, len);
++}
++
++SHOW_FMT(index, "%d", wiphy_idx, RO);
++SHOW_FMT(macaddress, "%pM", wiphy.perm_addr, RW);
++SHOW_FMT(address_mask, "%pM", wiphy.addr_mask, RO);
+
+ static ssize_t name_show(struct device *dev,
+ struct device_attribute *attr,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/150-disable_addr_notifier.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/150-disable_addr_notifier.patch
new file mode 100644
index 0000000..7ad5427
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/150-disable_addr_notifier.patch
@@ -0,0 +1,75 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 24 Feb 2013 00:00:00 +0100
+Subject: [PATCH] mac80211: disable ipv4/ipv6 address notifiers
+
+---
+ net/mac80211/main.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -337,7 +337,7 @@ void ieee80211_restart_hw(struct ieee802
+ }
+ EXPORT_SYMBOL(ieee80211_restart_hw);
+
+-#ifdef CONFIG_INET
++#ifdef __disabled__CONFIG_INET
+ static int ieee80211_ifa_changed(struct notifier_block *nb,
+ unsigned long data, void *arg)
+ {
+@@ -396,7 +396,7 @@ static int ieee80211_ifa_changed(struct
+ }
+ #endif
+
+-#if IS_ENABLED(CONFIG_IPV6)
++#if IS_ENABLED(__disabled__CONFIG_IPV6)
+ static int ieee80211_ifa6_changed(struct notifier_block *nb,
+ unsigned long data, void *arg)
+ {
+@@ -1321,14 +1321,14 @@ int ieee80211_register_hw(struct ieee802
+ wiphy_unlock(hw->wiphy);
+ rtnl_unlock();
+
+-#ifdef CONFIG_INET
++#ifdef __disabled__CONFIG_INET
+ local->ifa_notifier.notifier_call = ieee80211_ifa_changed;
+ result = register_inetaddr_notifier(&local->ifa_notifier);
+ if (result)
+ goto fail_ifa;
+ #endif
+
+-#if IS_ENABLED(CONFIG_IPV6)
++#if IS_ENABLED(__disabled__CONFIG_IPV6)
+ local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
+ result = register_inet6addr_notifier(&local->ifa6_notifier);
+ if (result)
+@@ -1337,13 +1337,13 @@ int ieee80211_register_hw(struct ieee802
+
+ return 0;
+
+-#if IS_ENABLED(CONFIG_IPV6)
++#if IS_ENABLED(__disabled__CONFIG_IPV6)
+ fail_ifa6:
+-#ifdef CONFIG_INET
++#ifdef __disabled__CONFIG_INET
+ unregister_inetaddr_notifier(&local->ifa_notifier);
+ #endif
+ #endif
+-#if defined(CONFIG_INET) || defined(CONFIG_IPV6)
++#if defined(__disabled__CONFIG_INET) || defined(__disabled__CONFIG_IPV6)
+ fail_ifa:
+ #endif
+ wiphy_unregister(local->hw.wiphy);
+@@ -1373,10 +1373,10 @@ void ieee80211_unregister_hw(struct ieee
+ tasklet_kill(&local->tx_pending_tasklet);
+ tasklet_kill(&local->tasklet);
+
+-#ifdef CONFIG_INET
++#ifdef __disabled__CONFIG_INET
+ unregister_inetaddr_notifier(&local->ifa_notifier);
+ #endif
+-#if IS_ENABLED(CONFIG_IPV6)
++#if IS_ENABLED(__disabled__CONFIG_IPV6)
+ unregister_inet6addr_notifier(&local->ifa6_notifier);
+ #endif
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/210-ap_scan.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/210-ap_scan.patch
new file mode 100644
index 0000000..9b8e084
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/210-ap_scan.patch
@@ -0,0 +1,19 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 3 Oct 2012 00:00:00 +0200
+Subject: [PATCH] mac80211: allow scans in access point mode (for site survey)
+
+---
+ net/mac80211/cfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2497,7 +2497,7 @@ static int ieee80211_scan(struct wiphy *
+ * the frames sent while scanning on other channel will be
+ * lost)
+ */
+- if (sdata->u.ap.beacon &&
++ if (0 && sdata->u.ap.beacon &&
+ (!(wiphy->features & NL80211_FEATURE_AP_SCAN) ||
+ !(req->flags & NL80211_SCAN_FLAG_AP)))
+ return -EOPNOTSUPP;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
new file mode 100644
index 0000000..d09d707
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
@@ -0,0 +1,38 @@
+From b478e06a16a8baa00c5ecc87c1d636981f2206d5 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 29 Oct 2019 10:25:25 +0100
+Subject: [PATCH] mac80211: sta: randomize BA session dialog token allocator
+
+We currently always start the dialog token generator at zero,
+so the first dialog token we use is always 1. This would be
+OK if we had a perfect guarantee that we always do a proper
+deauth/re-auth handshake, but in IBSS mode this doesn't always
+happen properly.
+
+To make problems with block ack (aggregation) sessions getting
+stuck less likely, randomize the dialog token so if we start a
+new session but the peer still has old state for us, it can
+better detect this.
+
+This is really just a workaround to make things a bit more
+robust than they are now - a better fix would be to do a full
+authentication handshake in IBSS mode upon having discovered a
+new station, and on the receiver resetting the state (removing
+and re-adding the station) on receiving the authentication
+packet.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ net/mac80211/sta_info.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -357,6 +357,7 @@ struct sta_info *sta_info_alloc(struct i
+ INIT_WORK(&sta->drv_deliver_wk, sta_deliver_ps_frames);
+ INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
+ mutex_init(&sta->ampdu_mlme.mtx);
++ sta->ampdu_mlme.dialog_token_allocator = prandom_u32_max(U8_MAX);
+ #ifdef CPTCFG_MAC80211_MESH
+ if (ieee80211_vif_is_mesh(&sdata->vif)) {
+ sta->mesh = kzalloc(sizeof(*sta->mesh), gfp);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/303-v5.16-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/303-v5.16-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch
new file mode 100644
index 0000000..159aad5
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/303-v5.16-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch
@@ -0,0 +1,62 @@
+From: Xing Song <xing.song@mediatek.com>
+Date: Tue, 23 Nov 2021 11:31:23 +0800
+Subject: [PATCH] mac80211: set up the fwd_skb->dev for mesh forwarding
+
+Mesh forwarding requires that the fwd_skb->dev is set up for TX handling,
+otherwise the following warning will be generated, so set it up for the
+pending frames.
+
+[ 72.835674 ] WARNING: CPU: 0 PID: 1193 at __skb_flow_dissect+0x284/0x1298
+[ 72.842379 ] Modules linked in: ksmbd pppoe ppp_async l2tp_ppp ...
+[ 72.962020 ] CPU: 0 PID: 1193 Comm: kworker/u5:1 Tainted: P S 5.4.137 #0
+[ 72.969938 ] Hardware name: MT7622_MT7531 RFB (DT)
+[ 72.974659 ] Workqueue: napi_workq napi_workfn
+[ 72.979025 ] pstate: 60000005 (nZCv daif -PAN -UAO)
+[ 72.983822 ] pc : __skb_flow_dissect+0x284/0x1298
+[ 72.988444 ] lr : __skb_flow_dissect+0x54/0x1298
+[ 72.992977 ] sp : ffffffc010c738c0
+[ 72.996293 ] x29: ffffffc010c738c0 x28: 0000000000000000
+[ 73.001615 ] x27: 000000000000ffc2 x26: ffffff800c2eb818
+[ 73.006937 ] x25: ffffffc010a987c8 x24: 00000000000000ce
+[ 73.012259 ] x23: ffffffc010c73a28 x22: ffffffc010a99c60
+[ 73.017581 ] x21: 000000000000ffc2 x20: ffffff80094da800
+[ 73.022903 ] x19: 0000000000000000 x18: 0000000000000014
+[ 73.028226 ] x17: 00000000084d16af x16: 00000000d1fc0bab
+[ 73.033548 ] x15: 00000000715f6034 x14: 000000009dbdd301
+[ 73.038870 ] x13: 00000000ea4dcbc3 x12: 0000000000000040
+[ 73.044192 ] x11: 000000000eb00ff0 x10: 0000000000000000
+[ 73.049513 ] x9 : 000000000eb00073 x8 : 0000000000000088
+[ 73.054834 ] x7 : 0000000000000000 x6 : 0000000000000001
+[ 73.060155 ] x5 : 0000000000000000 x4 : 0000000000000000
+[ 73.065476 ] x3 : ffffffc010a98000 x2 : 0000000000000000
+[ 73.070797 ] x1 : 0000000000000000 x0 : 0000000000000000
+[ 73.076120 ] Call trace:
+[ 73.078572 ] __skb_flow_dissect+0x284/0x1298
+[ 73.082846 ] __skb_get_hash+0x7c/0x228
+[ 73.086629 ] ieee80211_txq_may_transmit+0x7fc/0x17b8 [mac80211]
+[ 73.092564 ] ieee80211_tx_prepare_skb+0x20c/0x268 [mac80211]
+[ 73.098238 ] ieee80211_tx_pending+0x144/0x330 [mac80211]
+[ 73.103560 ] tasklet_action_common.isra.16+0xb4/0x158
+[ 73.108618 ] tasklet_action+0x2c/0x38
+[ 73.112286 ] __do_softirq+0x168/0x3b0
+[ 73.115954 ] do_softirq.part.15+0x88/0x98
+[ 73.119969 ] __local_bh_enable_ip+0xb0/0xb8
+[ 73.124156 ] napi_workfn+0x58/0x90
+[ 73.127565 ] process_one_work+0x20c/0x478
+[ 73.131579 ] worker_thread+0x50/0x4f0
+[ 73.135249 ] kthread+0x124/0x128
+[ 73.138484 ] ret_from_fork+0x10/0x1c
+
+Signed-off-by: Xing Song <xing.song@mediatek.com>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2950,6 +2950,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ if (!fwd_skb)
+ goto out;
+
++ fwd_skb->dev = sdata->dev;
+ fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
+ fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
+ info = IEEE80211_SKB_CB(fwd_skb);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-v5.17-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-v5.17-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch
new file mode 100644
index 0000000..c43cd3a
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-v5.17-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch
@@ -0,0 +1,60 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 14 Dec 2021 17:53:12 +0100
+Subject: [PATCH] mac80211: use coarse boottime for airtime fairness code
+
+The time values used by the airtime fairness code only need to be accurate
+enough to cover station activity detection.
+Using ktime_get_coarse_boottime_ns instead of ktime_get_boottime_ns will
+drop the accuracy down to jiffies intervals, but at the same time saves
+a lot of CPU cycles in a hot path
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3820,7 +3820,7 @@ struct ieee80211_txq *ieee80211_next_txq
+ {
+ struct ieee80211_local *local = hw_to_local(hw);
+ struct airtime_sched_info *air_sched;
+- u64 now = ktime_get_boottime_ns();
++ u64 now = ktime_get_coarse_boottime_ns();
+ struct ieee80211_txq *ret = NULL;
+ struct airtime_info *air_info;
+ struct txq_info *txqi = NULL;
+@@ -3947,7 +3947,7 @@ void ieee80211_update_airtime_weight(str
+ u64 weight_sum = 0;
+
+ if (unlikely(!now))
+- now = ktime_get_boottime_ns();
++ now = ktime_get_coarse_boottime_ns();
+
+ lockdep_assert_held(&air_sched->lock);
+
+@@ -3973,7 +3973,7 @@ void ieee80211_schedule_txq(struct ieee8
+ struct ieee80211_local *local = hw_to_local(hw);
+ struct txq_info *txqi = to_txq_info(txq);
+ struct airtime_sched_info *air_sched;
+- u64 now = ktime_get_boottime_ns();
++ u64 now = ktime_get_coarse_boottime_ns();
+ struct airtime_info *air_info;
+ u8 ac = txq->ac;
+ bool was_active;
+@@ -4031,7 +4031,7 @@ static void __ieee80211_unschedule_txq(s
+
+ if (!purge)
+ airtime_set_active(air_sched, air_info,
+- ktime_get_boottime_ns());
++ ktime_get_coarse_boottime_ns());
+
+ rb_erase_cached(&txqi->schedule_order,
+ &air_sched->active_txqs);
+@@ -4119,7 +4119,7 @@ bool ieee80211_txq_may_transmit(struct i
+ if (RB_EMPTY_NODE(&txqi->schedule_order))
+ goto out;
+
+- now = ktime_get_boottime_ns();
++ now = ktime_get_coarse_boottime_ns();
+
+ /* Like in ieee80211_next_txq(), make sure the first station in the
+ * scheduling order is eligible for transmission to avoid starvation.
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/307-mac80211_hwsim-make-6-GHz-channels-usable.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/307-mac80211_hwsim-make-6-GHz-channels-usable.patch
new file mode 100644
index 0000000..9c3b38a
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/307-mac80211_hwsim-make-6-GHz-channels-usable.patch
@@ -0,0 +1,74 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 24 May 2021 11:46:09 +0200
+Subject: [PATCH] mac80211_hwsim: make 6 GHz channels usable
+
+The previous commit that claimed to add 6 GHz channels didn't actually make
+them usable, since the 6 GHz band was not registered with mac80211.
+
+Fixes: 28881922abd7 ("mac80211_hwsim: add 6GHz channels")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3008,15 +3008,19 @@ static void mac80211_hwsim_he_capab(stru
+ {
+ u16 n_iftype_data;
+
+- if (sband->band == NL80211_BAND_2GHZ) {
++ switch (sband->band) {
++ case NL80211_BAND_2GHZ:
+ n_iftype_data = ARRAY_SIZE(he_capa_2ghz);
+ sband->iftype_data =
+ (struct ieee80211_sband_iftype_data *)he_capa_2ghz;
+- } else if (sband->band == NL80211_BAND_5GHZ) {
++ break;
++ case NL80211_BAND_5GHZ:
++ case NL80211_BAND_6GHZ:
+ n_iftype_data = ARRAY_SIZE(he_capa_5ghz);
+ sband->iftype_data =
+ (struct ieee80211_sband_iftype_data *)he_capa_5ghz;
+- } else {
++ break;
++ default:
+ return;
+ }
+
+@@ -3306,6 +3310,12 @@ static int mac80211_hwsim_new_radio(stru
+ sband->vht_cap.vht_mcs.tx_mcs_map =
+ sband->vht_cap.vht_mcs.rx_mcs_map;
+ break;
++ case NL80211_BAND_6GHZ:
++ sband->channels = data->channels_6ghz;
++ sband->n_channels = ARRAY_SIZE(hwsim_channels_6ghz);
++ sband->bitrates = data->rates + 4;
++ sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
++ break;
+ case NL80211_BAND_S1GHZ:
+ memcpy(&sband->s1g_cap, &hwsim_s1g_cap,
+ sizeof(sband->s1g_cap));
+@@ -3316,6 +3326,13 @@ static int mac80211_hwsim_new_radio(stru
+ continue;
+ }
+
++ mac80211_hwsim_he_capab(sband);
++
++ hw->wiphy->bands[band] = sband;
++
++ if (band == NL80211_BAND_6GHZ)
++ continue;
++
+ sband->ht_cap.ht_supported = true;
+ sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+ IEEE80211_HT_CAP_GRN_FLD |
+@@ -3329,10 +3346,6 @@ static int mac80211_hwsim_new_radio(stru
+ sband->ht_cap.mcs.rx_mask[0] = 0xff;
+ sband->ht_cap.mcs.rx_mask[1] = 0xff;
+ sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+-
+- mac80211_hwsim_he_capab(sband);
+-
+- hw->wiphy->bands[band] = sband;
+ }
+
+ /* By default all radios belong to the first group */
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/308-v5.17-mac80211-add-support-for-.ndo_fill_forward_path.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/308-v5.17-mac80211-add-support-for-.ndo_fill_forward_path.patch
new file mode 100644
index 0000000..a9a6182
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/308-v5.17-mac80211-add-support-for-.ndo_fill_forward_path.patch
@@ -0,0 +1,178 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 12 Nov 2021 12:22:23 +0100
+Subject: [PATCH] mac80211: add support for .ndo_fill_forward_path
+
+This allows drivers to provide a destination device + info for flow offload
+Only supported in combination with 802.3 encap offload
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Tested-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/20211112112223.1209-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -3937,6 +3937,8 @@ struct ieee80211_prep_tx_info {
+ * twt structure.
+ * @twt_teardown_request: Update the hw with TWT teardown request received
+ * from the peer.
++ * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
++ * resolve a path for hardware flow offloading
+ */
+ struct ieee80211_ops {
+ void (*tx)(struct ieee80211_hw *hw,
+@@ -4265,6 +4267,13 @@ struct ieee80211_ops {
+ struct ieee80211_twt_setup *twt);
+ void (*twt_teardown_request)(struct ieee80211_hw *hw,
+ struct ieee80211_sta *sta, u8 flowid);
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++ int (*net_fill_forward_path)(struct ieee80211_hw *hw,
++ struct ieee80211_vif *vif,
++ struct ieee80211_sta *sta,
++ struct net_device_path_ctx *ctx,
++ struct net_device_path *path);
++#endif
+ };
+
+ /**
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1486,4 +1486,28 @@ static inline void drv_twt_teardown_requ
+ trace_drv_return_void(local);
+ }
+
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
++ struct ieee80211_sub_if_data *sdata,
++ struct ieee80211_sta *sta,
++ struct net_device_path_ctx *ctx,
++ struct net_device_path *path)
++{
++ int ret = -EOPNOTSUPP;
++
++ sdata = get_bss_sdata(sdata);
++ if (!check_sdata_in_driver(sdata))
++ return -EIO;
++
++ trace_drv_net_fill_forward_path(local, sdata, sta);
++ if (local->ops->net_fill_forward_path)
++ ret = local->ops->net_fill_forward_path(&local->hw,
++ &sdata->vif, sta,
++ ctx, path);
++ trace_drv_return_int(local, ret);
++
++ return ret;
++}
++#endif
++
+ #endif /* __MAC80211_DRIVER_OPS */
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1489,7 +1489,7 @@ struct ieee80211_local {
+ };
+
+ static inline struct ieee80211_sub_if_data *
+-IEEE80211_DEV_TO_SUB_IF(struct net_device *dev)
++IEEE80211_DEV_TO_SUB_IF(const struct net_device *dev)
+ {
+ return netdev_priv(dev);
+ }
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -822,6 +822,66 @@ static const struct net_device_ops ieee8
+
+ };
+
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++static int ieee80211_netdev_fill_forward_path(struct net_device_path_ctx *ctx,
++ struct net_device_path *path)
++{
++ struct ieee80211_sub_if_data *sdata;
++ struct ieee80211_local *local;
++ struct sta_info *sta;
++ int ret = -ENOENT;
++
++ sdata = IEEE80211_DEV_TO_SUB_IF(ctx->dev);
++ local = sdata->local;
++
++ if (!local->ops->net_fill_forward_path)
++ return -EOPNOTSUPP;
++
++ rcu_read_lock();
++ switch (sdata->vif.type) {
++ case NL80211_IFTYPE_AP_VLAN:
++ sta = rcu_dereference(sdata->u.vlan.sta);
++ if (sta)
++ break;
++ if (sdata->wdev.use_4addr)
++ goto out;
++ if (is_multicast_ether_addr(ctx->daddr))
++ goto out;
++ sta = sta_info_get_bss(sdata, ctx->daddr);
++ break;
++ case NL80211_IFTYPE_AP:
++ if (is_multicast_ether_addr(ctx->daddr))
++ goto out;
++ sta = sta_info_get(sdata, ctx->daddr);
++ break;
++ case NL80211_IFTYPE_STATION:
++ if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
++ sta = sta_info_get(sdata, ctx->daddr);
++ if (sta && test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
++ if (!test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
++ goto out;
++
++ break;
++ }
++ }
++
++ sta = sta_info_get(sdata, sdata->u.mgd.bssid);
++ break;
++ default:
++ goto out;
++ }
++
++ if (!sta)
++ goto out;
++
++ ret = drv_net_fill_forward_path(local, sdata, &sta->sta, ctx, path);
++out:
++ rcu_read_unlock();
++
++ return ret;
++}
++#endif
++
+ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+ #if LINUX_VERSION_IS_LESS(4,10,0)
+ .ndo_change_mtu = __change_mtu,
+@@ -839,7 +899,9 @@ static const struct net_device_ops ieee8
+ #else
+ .ndo_get_stats64 = bp_ieee80211_get_stats64,
+ #endif
+-
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++ .ndo_fill_forward_path = ieee80211_netdev_fill_forward_path,
++#endif
+ };
+
+ static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -2892,6 +2892,15 @@ TRACE_EVENT(drv_twt_teardown_request,
+ )
+ );
+
++#if LINUX_VERSION_IS_GEQ(5,10,0)
++DEFINE_EVENT(sta_event, drv_net_fill_forward_path,
++ TP_PROTO(struct ieee80211_local *local,
++ struct ieee80211_sub_if_data *sdata,
++ struct ieee80211_sta *sta),
++ TP_ARGS(local, sdata, sta)
++);
++#endif
++
+ #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
+
+ #undef TRACE_INCLUDE_PATH
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/309-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/309-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
new file mode 100644
index 0000000..0d475b7
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/309-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 28 Apr 2021 21:03:13 +0200
+Subject: [PATCH] mac80211: minstrel_ht: fix MINSTREL_FRAC macro
+
+Add missing braces to avoid issues with e.g. using additions in the
+div expression
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.h
++++ b/net/mac80211/rc80211_minstrel_ht.h
+@@ -14,7 +14,7 @@
+
+ /* scaled fraction values */
+ #define MINSTREL_SCALE 12
+-#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / div)
++#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / (div))
+ #define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
+
+ #define EWMA_LEVEL 96 /* ewma weighting factor [/EWMA_DIV] */
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
new file mode 100644
index 0000000..3be43b8
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
@@ -0,0 +1,30 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 6 Feb 2021 16:08:01 +0100
+Subject: [PATCH] mac80211: minstrel_ht: reduce fluctuations in rate
+ probability stats
+
+In some scenarios when there is a lot of fluctuation in packet error rates,
+rate switching can be amplified when the statistics get skewed by time slots
+with very few tries.
+Make the input data to the moving average more smooth by adding the
+success/attempts count from the last stats window as well. This has the
+advantage of smoothing the data without introducing any extra lag to sampling
+rates.
+This significantly improves rate stability on a strong test link subjected to
+periodic noise bursts generated with a SDR
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -703,7 +703,8 @@ minstrel_ht_calc_rate_stats(struct minst
+ unsigned int cur_prob;
+
+ if (unlikely(mrs->attempts > 0)) {
+- cur_prob = MINSTREL_FRAC(mrs->success, mrs->attempts);
++ cur_prob = MINSTREL_FRAC(mrs->success + mrs->last_success,
++ mrs->attempts + mrs->last_attempts);
+ minstrel_filter_avg_add(&mrs->prob_avg,
+ &mrs->prob_avg_1, cur_prob);
+ mrs->att_hist += mrs->attempts;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
new file mode 100644
index 0000000..13bed48
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
@@ -0,0 +1,151 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 6 Feb 2021 16:33:14 +0100
+Subject: [PATCH] mac80211: minstrel_ht: rework rate downgrade code and
+ max_prob rate selection
+
+The current fallback code for fast rate switching on potentially failing rates
+is triggering too often if there is some strong noise on the channel. This can
+lead to wild fluctuations in the rate selection.
+Additionally, switching down to max_prob_rate can create a significant gap down
+in throughput, especially when using only 2 spatial streams, because max_prob_rate
+is limited to using fewer streams than the max_tp rates.
+In order to improve throughput without reducing reliability too much, use the
+rate downgrade code for the max_prob_rate only, and allow the non-downgraded
+max_prob_rate to use as many spatial streams as the max_tp rates
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -514,6 +514,14 @@ minstrel_ht_set_best_prob_rate(struct mi
+ int cur_tp_avg, cur_group, cur_idx;
+ int max_gpr_group, max_gpr_idx;
+ int max_gpr_tp_avg, max_gpr_prob;
++ int min_dur;
++
++ min_dur = max(minstrel_get_duration(mi->max_tp_rate[0]),
++ minstrel_get_duration(mi->max_tp_rate[1]));
++
++ /* make the rate at least 18% slower than max tp rates */
++ if (minstrel_get_duration(index) <= min_dur * 19 / 16)
++ return;
+
+ cur_group = MI_RATE_GROUP(index);
+ cur_idx = MI_RATE_IDX(index);
+@@ -535,11 +543,6 @@ minstrel_ht_set_best_prob_rate(struct mi
+ !minstrel_ht_is_legacy_group(max_tp_group))
+ return;
+
+- /* skip rates faster than max tp rate with lower prob */
+- if (minstrel_get_duration(mi->max_tp_rate[0]) > minstrel_get_duration(index) &&
+- mrs->prob_avg < max_tp_prob)
+- return;
+-
+ max_gpr_group = MI_RATE_GROUP(mg->max_group_prob_rate);
+ max_gpr_idx = MI_RATE_IDX(mg->max_group_prob_rate);
+ max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_avg;
+@@ -597,40 +600,6 @@ minstrel_ht_assign_best_tp_rates(struct
+
+ }
+
+-/*
+- * Try to increase robustness of max_prob rate by decrease number of
+- * streams if possible.
+- */
+-static inline void
+-minstrel_ht_prob_rate_reduce_streams(struct minstrel_ht_sta *mi)
+-{
+- struct minstrel_mcs_group_data *mg;
+- int tmp_max_streams, group, tmp_idx, tmp_prob;
+- int tmp_tp = 0;
+-
+- if (!mi->sta->ht_cap.ht_supported)
+- return;
+-
+- group = MI_RATE_GROUP(mi->max_tp_rate[0]);
+- tmp_max_streams = minstrel_mcs_groups[group].streams;
+- for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
+- mg = &mi->groups[group];
+- if (!mi->supported[group] || group == MINSTREL_CCK_GROUP)
+- continue;
+-
+- tmp_idx = MI_RATE_IDX(mg->max_group_prob_rate);
+- tmp_prob = mi->groups[group].rates[tmp_idx].prob_avg;
+-
+- if (tmp_tp < minstrel_ht_get_tp_avg(mi, group, tmp_idx, tmp_prob) &&
+- (minstrel_mcs_groups[group].streams < tmp_max_streams)) {
+- mi->max_prob_rate = mg->max_group_prob_rate;
+- tmp_tp = minstrel_ht_get_tp_avg(mi, group,
+- tmp_idx,
+- tmp_prob);
+- }
+- }
+-}
+-
+ static u16
+ __minstrel_ht_get_sample_rate(struct minstrel_ht_sta *mi,
+ enum minstrel_sample_type type)
+@@ -1110,8 +1079,6 @@ minstrel_ht_update_stats(struct minstrel
+
+ mi->max_prob_rate = tmp_max_prob_rate;
+
+- /* Try to increase robustness of max_prob_rate*/
+- minstrel_ht_prob_rate_reduce_streams(mi);
+ minstrel_ht_refill_sample_rates(mi);
+
+ #ifdef CPTCFG_MAC80211_DEBUGFS
+@@ -1156,7 +1123,7 @@ minstrel_ht_txstat_valid(struct minstrel
+ }
+
+ static void
+-minstrel_downgrade_rate(struct minstrel_ht_sta *mi, u16 *idx, bool primary)
++minstrel_downgrade_prob_rate(struct minstrel_ht_sta *mi, u16 *idx)
+ {
+ int group, orig_group;
+
+@@ -1171,11 +1138,7 @@ minstrel_downgrade_rate(struct minstrel_
+ minstrel_mcs_groups[orig_group].streams)
+ continue;
+
+- if (primary)
+- *idx = mi->groups[group].max_group_tp_rate[0];
+- else
+- *idx = mi->groups[group].max_group_tp_rate[1];
+- break;
++ *idx = mi->groups[group].max_group_prob_rate;
+ }
+ }
+
+@@ -1186,7 +1149,7 @@ minstrel_ht_tx_status(void *priv, struct
+ struct ieee80211_tx_info *info = st->info;
+ struct minstrel_ht_sta *mi = priv_sta;
+ struct ieee80211_tx_rate *ar = info->status.rates;
+- struct minstrel_rate_stats *rate, *rate2;
++ struct minstrel_rate_stats *rate;
+ struct minstrel_priv *mp = priv;
+ u32 update_interval = mp->update_interval;
+ bool last, update = false;
+@@ -1236,18 +1199,13 @@ minstrel_ht_tx_status(void *priv, struct
+ /*
+ * check for sudden death of spatial multiplexing,
+ * downgrade to a lower number of streams if necessary.
++ * only do this for the max_prob_rate to prevent spurious
++ * rate fluctuations when the link changes suddenly
+ */
+- rate = minstrel_get_ratestats(mi, mi->max_tp_rate[0]);
++ rate = minstrel_get_ratestats(mi, mi->max_prob_rate);
+ if (rate->attempts > 30 &&
+ rate->success < rate->attempts / 4) {
+- minstrel_downgrade_rate(mi, &mi->max_tp_rate[0], true);
+- update = true;
+- }
+-
+- rate2 = minstrel_get_ratestats(mi, mi->max_tp_rate[1]);
+- if (rate2->attempts > 30 &&
+- rate2->success < rate2->attempts / 4) {
+- minstrel_downgrade_rate(mi, &mi->max_tp_rate[1], false);
++ minstrel_downgrade_prob_rate(mi, &mi->max_prob_rate);
+ update = true;
+ }
+ }
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/312-v5.16-mac80211-split-beacon-retrieval-functions.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/312-v5.16-mac80211-split-beacon-retrieval-functions.patch
new file mode 100644
index 0000000..18b1951
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/312-v5.16-mac80211-split-beacon-retrieval-functions.patch
@@ -0,0 +1,262 @@
+From: Aloka Dixit <alokad@codeaurora.org>
+Date: Tue, 5 Oct 2021 21:09:36 -0700
+Subject: [PATCH] mac80211: split beacon retrieval functions
+
+Split __ieee80211_beacon_get() into a separate function for AP mode
+ieee80211_beacon_get_ap().
+Also, move the code common to all modes (AP, adhoc and mesh) to
+a separate function ieee80211_beacon_get_finish().
+
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Link: https://lore.kernel.org/r/20211006040938.9531-2-alokad@codeaurora.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4987,6 +4987,115 @@ static int ieee80211_beacon_protect(stru
+ return 0;
+ }
+
++static void
++ieee80211_beacon_get_finish(struct ieee80211_hw *hw,
++ struct ieee80211_vif *vif,
++ struct ieee80211_mutable_offsets *offs,
++ struct beacon_data *beacon,
++ struct sk_buff *skb,
++ struct ieee80211_chanctx_conf *chanctx_conf,
++ u16 csa_off_base)
++{
++ struct ieee80211_local *local = hw_to_local(hw);
++ struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
++ struct ieee80211_tx_info *info;
++ enum nl80211_band band;
++ struct ieee80211_tx_rate_control txrc;
++
++ /* CSA offsets */
++ if (offs && beacon) {
++ u16 i;
++
++ for (i = 0; i < IEEE80211_MAX_CNTDWN_COUNTERS_NUM; i++) {
++ u16 csa_off = beacon->cntdwn_counter_offsets[i];
++
++ if (!csa_off)
++ continue;
++
++ offs->cntdwn_counter_offs[i] = csa_off_base + csa_off;
++ }
++ }
++
++ band = chanctx_conf->def.chan->band;
++ info = IEEE80211_SKB_CB(skb);
++ info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
++ info->flags |= IEEE80211_TX_CTL_NO_ACK;
++ info->band = band;
++
++ memset(&txrc, 0, sizeof(txrc));
++ txrc.hw = hw;
++ txrc.sband = local->hw.wiphy->bands[band];
++ txrc.bss_conf = &sdata->vif.bss_conf;
++ txrc.skb = skb;
++ txrc.reported_rate.idx = -1;
++ if (sdata->beacon_rate_set && sdata->beacon_rateidx_mask[band])
++ txrc.rate_idx_mask = sdata->beacon_rateidx_mask[band];
++ else
++ txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
++ txrc.bss = true;
++ rate_control_get_rate(sdata, NULL, &txrc);
++
++ info->control.vif = vif;
++ info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
++ IEEE80211_TX_CTL_ASSIGN_SEQ |
++ IEEE80211_TX_CTL_FIRST_FRAGMENT;
++}
++
++static struct sk_buff *
++ieee80211_beacon_get_ap(struct ieee80211_hw *hw,
++ struct ieee80211_vif *vif,
++ struct ieee80211_mutable_offsets *offs,
++ bool is_template,
++ struct beacon_data *beacon,
++ struct ieee80211_chanctx_conf *chanctx_conf)
++{
++ struct ieee80211_local *local = hw_to_local(hw);
++ struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
++ struct ieee80211_if_ap *ap = &sdata->u.ap;
++ struct sk_buff *skb = NULL;
++ u16 csa_off_base = 0;
++
++ if (beacon->cntdwn_counter_offsets[0]) {
++ if (!is_template)
++ ieee80211_beacon_update_cntdwn(vif);
++
++ ieee80211_set_beacon_cntdwn(sdata, beacon);
++ }
++
++ /* headroom, head length,
++ * tail length and maximum TIM length
++ */
++ skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
++ beacon->tail_len + 256 +
++ local->hw.extra_beacon_tailroom);
++ if (!skb)
++ return NULL;
++
++ skb_reserve(skb, local->tx_headroom);
++ skb_put_data(skb, beacon->head, beacon->head_len);
++
++ ieee80211_beacon_add_tim(sdata, &ap->ps, skb, is_template);
++
++ if (offs) {
++ offs->tim_offset = beacon->head_len;
++ offs->tim_length = skb->len - beacon->head_len;
++ offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
++
++ /* for AP the csa offsets are from tail */
++ csa_off_base = skb->len;
++ }
++
++ if (beacon->tail)
++ skb_put_data(skb, beacon->tail, beacon->tail_len);
++
++ if (ieee80211_beacon_protect(skb, local, sdata) < 0)
++ return NULL;
++
++ ieee80211_beacon_get_finish(hw, vif, offs, beacon, skb, chanctx_conf,
++ csa_off_base);
++ return skb;
++}
++
+ static struct sk_buff *
+ __ieee80211_beacon_get(struct ieee80211_hw *hw,
+ struct ieee80211_vif *vif,
+@@ -4996,12 +5105,8 @@ __ieee80211_beacon_get(struct ieee80211_
+ struct ieee80211_local *local = hw_to_local(hw);
+ struct beacon_data *beacon = NULL;
+ struct sk_buff *skb = NULL;
+- struct ieee80211_tx_info *info;
+ struct ieee80211_sub_if_data *sdata = NULL;
+- enum nl80211_band band;
+- struct ieee80211_tx_rate_control txrc;
+ struct ieee80211_chanctx_conf *chanctx_conf;
+- int csa_off_base = 0;
+
+ rcu_read_lock();
+
+@@ -5018,48 +5123,11 @@ __ieee80211_beacon_get(struct ieee80211_
+ struct ieee80211_if_ap *ap = &sdata->u.ap;
+
+ beacon = rcu_dereference(ap->beacon);
+- if (beacon) {
+- if (beacon->cntdwn_counter_offsets[0]) {
+- if (!is_template)
+- ieee80211_beacon_update_cntdwn(vif);
+-
+- ieee80211_set_beacon_cntdwn(sdata, beacon);
+- }
+-
+- /*
+- * headroom, head length,
+- * tail length and maximum TIM length
+- */
+- skb = dev_alloc_skb(local->tx_headroom +
+- beacon->head_len +
+- beacon->tail_len + 256 +
+- local->hw.extra_beacon_tailroom);
+- if (!skb)
+- goto out;
+-
+- skb_reserve(skb, local->tx_headroom);
+- skb_put_data(skb, beacon->head, beacon->head_len);
+-
+- ieee80211_beacon_add_tim(sdata, &ap->ps, skb,
+- is_template);
+-
+- if (offs) {
+- offs->tim_offset = beacon->head_len;
+- offs->tim_length = skb->len - beacon->head_len;
+- offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
+-
+- /* for AP the csa offsets are from tail */
+- csa_off_base = skb->len;
+- }
+-
+- if (beacon->tail)
+- skb_put_data(skb, beacon->tail,
+- beacon->tail_len);
+-
+- if (ieee80211_beacon_protect(skb, local, sdata) < 0)
+- goto out;
+- } else
++ if (!beacon)
+ goto out;
++
++ skb = ieee80211_beacon_get_ap(hw, vif, offs, is_template,
++ beacon, chanctx_conf);
+ } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+ struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+ struct ieee80211_hdr *hdr;
+@@ -5085,6 +5153,9 @@ __ieee80211_beacon_get(struct ieee80211_
+ hdr = (struct ieee80211_hdr *) skb->data;
+ hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+ IEEE80211_STYPE_BEACON);
++
++ ieee80211_beacon_get_finish(hw, vif, offs, beacon, skb,
++ chanctx_conf, 0);
+ } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
+ struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+
+@@ -5124,51 +5195,13 @@ __ieee80211_beacon_get(struct ieee80211_
+ }
+
+ skb_put_data(skb, beacon->tail, beacon->tail_len);
++ ieee80211_beacon_get_finish(hw, vif, offs, beacon, skb,
++ chanctx_conf, 0);
+ } else {
+ WARN_ON(1);
+ goto out;
+ }
+
+- /* CSA offsets */
+- if (offs && beacon) {
+- int i;
+-
+- for (i = 0; i < IEEE80211_MAX_CNTDWN_COUNTERS_NUM; i++) {
+- u16 csa_off = beacon->cntdwn_counter_offsets[i];
+-
+- if (!csa_off)
+- continue;
+-
+- offs->cntdwn_counter_offs[i] = csa_off_base + csa_off;
+- }
+- }
+-
+- band = chanctx_conf->def.chan->band;
+-
+- info = IEEE80211_SKB_CB(skb);
+-
+- info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+- info->flags |= IEEE80211_TX_CTL_NO_ACK;
+- info->band = band;
+-
+- memset(&txrc, 0, sizeof(txrc));
+- txrc.hw = hw;
+- txrc.sband = local->hw.wiphy->bands[band];
+- txrc.bss_conf = &sdata->vif.bss_conf;
+- txrc.skb = skb;
+- txrc.reported_rate.idx = -1;
+- if (sdata->beacon_rate_set && sdata->beacon_rateidx_mask[band])
+- txrc.rate_idx_mask = sdata->beacon_rateidx_mask[band];
+- else
+- txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
+- txrc.bss = true;
+- rate_control_get_rate(sdata, NULL, &txrc);
+-
+- info->control.vif = vif;
+-
+- info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
+- IEEE80211_TX_CTL_ASSIGN_SEQ |
+- IEEE80211_TX_CTL_FIRST_FRAGMENT;
+ out:
+ rcu_read_unlock();
+ return skb;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/313-v5.16-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/313-v5.16-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch
new file mode 100644
index 0000000..429886d
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/313-v5.16-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch
@@ -0,0 +1,493 @@
+From: John Crispin <john@phrozen.org>
+Date: Wed, 15 Sep 2021 19:54:34 -0700
+Subject: [PATCH] nl80211: MBSSID and EMA support in AP mode
+
+Add new attributes to configure support for multiple BSSID
+and advanced multi-BSSID advertisements (EMA) in AP mode.
+
+- NL80211_ATTR_MBSSID_CONFIG used for per interface configuration.
+- NL80211_ATTR_MBSSID_ELEMS used to MBSSID elements for beacons.
+
+Memory for the elements is allocated dynamically. This change frees
+the memory in existing functions which call nl80211_parse_beacon(),
+a comment is added to indicate the new references to do the same.
+
+Signed-off-by: John Crispin <john@phrozen.org>
+Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Link: https://lore.kernel.org/r/20210916025437.29138-2-alokad@codeaurora.org
+[don't leave ERR_PTR hanging around]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -1046,6 +1046,36 @@ struct cfg80211_crypto_settings {
+ };
+
+ /**
++ * struct cfg80211_mbssid_config - AP settings for multi bssid
++ *
++ * @tx_wdev: pointer to the transmitted interface in the MBSSID set
++ * @index: index of this AP in the multi bssid group.
++ * @ema: set to true if the beacons should be sent out in EMA mode.
++ */
++struct cfg80211_mbssid_config {
++ struct wireless_dev *tx_wdev;
++ u8 index;
++ bool ema;
++};
++
++/**
++ * struct cfg80211_mbssid_elems - Multiple BSSID elements
++ *
++ * @cnt: Number of elements in array %elems.
++ *
++ * @elem: Array of multiple BSSID element(s) to be added into Beacon frames.
++ * @elem.data: Data for multiple BSSID elements.
++ * @elem.len: Length of data.
++ */
++struct cfg80211_mbssid_elems {
++ u8 cnt;
++ struct {
++ const u8 *data;
++ size_t len;
++ } elem[];
++};
++
++/**
+ * struct cfg80211_beacon_data - beacon data
+ * @head: head portion of beacon (before TIM IE)
+ * or %NULL if not changed
+@@ -1063,6 +1093,7 @@ struct cfg80211_crypto_settings {
+ * @assocresp_ies_len: length of assocresp_ies in octets
+ * @probe_resp_len: length of probe response template (@probe_resp)
+ * @probe_resp: probe response template (AP mode only)
++ * @mbssid_ies: multiple BSSID elements
+ * @ftm_responder: enable FTM responder functionality; -1 for no change
+ * (which also implies no change in LCI/civic location data)
+ * @lci: Measurement Report element content, starting with Measurement Token
+@@ -1080,6 +1111,7 @@ struct cfg80211_beacon_data {
+ const u8 *probe_resp;
+ const u8 *lci;
+ const u8 *civicloc;
++ struct cfg80211_mbssid_elems *mbssid_ies;
+ s8 ftm_responder;
+
+ size_t head_len, tail_len;
+@@ -1194,6 +1226,7 @@ enum cfg80211_ap_settings_flags {
+ * @he_oper: HE operation IE (or %NULL if HE isn't enabled)
+ * @fils_discovery: FILS discovery transmission parameters
+ * @unsol_bcast_probe_resp: Unsolicited broadcast probe response parameters
++ * @mbssid_config: AP settings for multiple bssid
+ */
+ struct cfg80211_ap_settings {
+ struct cfg80211_chan_def chandef;
+@@ -1226,6 +1259,7 @@ struct cfg80211_ap_settings {
+ struct cfg80211_he_bss_color he_bss_color;
+ struct cfg80211_fils_discovery fils_discovery;
+ struct cfg80211_unsol_bcast_probe_resp unsol_bcast_probe_resp;
++ struct cfg80211_mbssid_config mbssid_config;
+ };
+
+ /**
+@@ -4986,6 +5020,13 @@ struct wiphy_iftype_akm_suites {
+ * %NL80211_TID_CONFIG_ATTR_RETRY_LONG attributes
+ * @sar_capa: SAR control capabilities
+ * @rfkill: a pointer to the rfkill structure
++ *
++ * @mbssid_max_interfaces: maximum number of interfaces supported by the driver
++ * in a multiple BSSID set. This field must be set to a non-zero value
++ * by the driver to advertise MBSSID support.
++ * @mbssid_max_ema_profile_periodicity: maximum profile periodicity supported by
++ * the driver. Setting this field to a non-zero value indicates that the
++ * driver supports enhanced multi-BSSID advertisements (EMA AP).
+ */
+ struct wiphy {
+ struct mutex mtx;
+@@ -5133,6 +5174,9 @@ struct wiphy {
+
+ struct rfkill *rfkill;
+
++ u8 mbssid_max_interfaces;
++ u8 ema_max_profile_periodicity;
++
+ char priv[] __aligned(NETDEV_ALIGN);
+ };
+
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -337,7 +337,10 @@
+ * @NL80211_CMD_DEL_INTERFACE: Virtual interface was deleted, has attributes
+ * %NL80211_ATTR_IFINDEX and %NL80211_ATTR_WIPHY. Can also be sent from
+ * userspace to request deletion of a virtual interface, then requires
+- * attribute %NL80211_ATTR_IFINDEX.
++ * attribute %NL80211_ATTR_IFINDEX. If multiple BSSID advertisements are
++ * enabled using %NL80211_ATTR_MBSSID_CONFIG, %NL80211_ATTR_MBSSID_ELEMS,
++ * and if this command is used for the transmitting interface, then all
++ * the non-transmitting interfaces are deleted as well.
+ *
+ * @NL80211_CMD_GET_KEY: Get sequence counter information for a key specified
+ * by %NL80211_ATTR_KEY_IDX and/or %NL80211_ATTR_MAC.
+@@ -2593,6 +2596,18 @@ enum nl80211_commands {
+ * @NL80211_ATTR_COLOR_CHANGE_ELEMS: Nested set of attributes containing the IE
+ * information for the time while performing a color switch.
+ *
++ * @NL80211_ATTR_MBSSID_CONFIG: Nested attribute for multiple BSSID
++ * advertisements (MBSSID) parameters in AP mode.
++ * Kernel uses this attribute to indicate the driver's support for MBSSID
++ * and enhanced multi-BSSID advertisements (EMA AP) to the userspace.
++ * Userspace should use this attribute to configure per interface MBSSID
++ * parameters.
++ * See &enum nl80211_mbssid_config_attributes for details.
++ *
++ * @NL80211_ATTR_MBSSID_ELEMS: Nested parameter to pass multiple BSSID elements.
++ * Mandatory parameter for the transmitting interface to enable MBSSID.
++ * Optional for the non-transmitting interfaces.
++ *
+ * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+ * @NL80211_ATTR_MAX: highest attribute number currently defined
+ * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3096,6 +3111,9 @@ enum nl80211_attrs {
+ NL80211_ATTR_COLOR_CHANGE_COLOR,
+ NL80211_ATTR_COLOR_CHANGE_ELEMS,
+
++ NL80211_ATTR_MBSSID_CONFIG,
++ NL80211_ATTR_MBSSID_ELEMS,
++
+ /* add attributes here, update the policy in nl80211.c */
+
+ __NL80211_ATTR_AFTER_LAST,
+@@ -7349,4 +7367,60 @@ enum nl80211_sar_specs_attrs {
+ NL80211_SAR_ATTR_SPECS_MAX = __NL80211_SAR_ATTR_SPECS_LAST - 1,
+ };
+
++/**
++ * enum nl80211_mbssid_config_attributes - multiple BSSID (MBSSID) and enhanced
++ * multi-BSSID advertisements (EMA) in AP mode.
++ * Kernel uses some of these attributes to advertise driver's support for
++ * MBSSID and EMA.
++ * Remaining attributes should be used by the userspace to configure the
++ * features.
++ *
++ * @__NL80211_MBSSID_CONFIG_ATTR_INVALID: Invalid
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES: Used by the kernel to advertise
++ * the maximum number of MBSSID interfaces supported by the driver.
++ * Driver should indicate MBSSID support by setting
++ * wiphy->mbssid_max_interfaces to a value more than or equal to 2.
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY: Used by the kernel
++ * to advertise the maximum profile periodicity supported by the driver
++ * if EMA is enabled. Driver should indicate EMA support to the userspace
++ * by setting wiphy->mbssid_max_ema_profile_periodicity to
++ * a non-zero value.
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_INDEX: Mandatory parameter to pass the index of
++ * this BSS (u8) in the multiple BSSID set.
++ * Value must be set to 0 for the transmitting interface and non-zero for
++ * all non-transmitting interfaces. The userspace will be responsible
++ * for using unique indices for the interfaces.
++ * Range: 0 to wiphy->mbssid_max_interfaces-1.
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX: Mandatory parameter for
++ * a non-transmitted profile which provides the interface index (u32) of
++ * the transmitted profile. The value must match one of the interface
++ * indices advertised by the kernel. Optional if the interface being set up
++ * is the transmitting one, however, if provided then the value must match
++ * the interface index of the same.
++ *
++ * @NL80211_MBSSID_CONFIG_ATTR_EMA: Flag used to enable EMA AP feature.
++ * Setting this flag is permitted only if the driver advertises EMA support
++ * by setting wiphy->mbssid_max_ema_profile_periodicity to non-zero.
++ *
++ * @__NL80211_MBSSID_CONFIG_ATTR_LAST: Internal
++ * @NL80211_MBSSID_CONFIG_ATTR_MAX: highest attribute
++ */
++enum nl80211_mbssid_config_attributes {
++ __NL80211_MBSSID_CONFIG_ATTR_INVALID,
++
++ NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
++ NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
++ NL80211_MBSSID_CONFIG_ATTR_INDEX,
++ NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX,
++ NL80211_MBSSID_CONFIG_ATTR_EMA,
++
++ /* keep last */
++ __NL80211_MBSSID_CONFIG_ATTR_LAST,
++ NL80211_MBSSID_CONFIG_ATTR_MAX = __NL80211_MBSSID_CONFIG_ATTR_LAST - 1,
++};
++
+ #endif /* __LINUX_NL80211_H */
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -442,6 +442,16 @@ sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
+ [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
+ };
+
++static const struct nla_policy
++nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
++ [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
++ [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
++ NLA_POLICY_MIN(NLA_U8, 1),
++ [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
++ [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
++ [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
++};
++
+ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
+ [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
+@@ -788,6 +798,9 @@ static const struct nla_policy nl80211_p
+ [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
+ [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
+ [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
++ [NL80211_ATTR_MBSSID_CONFIG] =
++ NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
++ [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
+ };
+
+ /* policy for the key attributes */
+@@ -2236,6 +2249,35 @@ fail:
+ return -ENOBUFS;
+ }
+
++static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
++{
++ struct nlattr *config;
++
++ if (!wiphy->mbssid_max_interfaces)
++ return 0;
++
++ config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
++ if (!config)
++ return -ENOBUFS;
++
++ if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
++ wiphy->mbssid_max_interfaces))
++ goto fail;
++
++ if (wiphy->ema_max_profile_periodicity &&
++ nla_put_u8(msg,
++ NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
++ wiphy->ema_max_profile_periodicity))
++ goto fail;
++
++ nla_nest_end(msg, config);
++ return 0;
++
++fail:
++ nla_nest_cancel(msg, config);
++ return -ENOBUFS;
++}
++
+ struct nl80211_dump_wiphy_state {
+ s64 filter_wiphy;
+ long start;
+@@ -2821,6 +2863,9 @@ static int nl80211_send_wiphy(struct cfg
+ if (nl80211_put_sar_specs(rdev, msg))
+ goto nla_put_failure;
+
++ if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
++ goto nla_put_failure;
++
+ /* done */
+ state->split_start = 0;
+ break;
+@@ -5020,6 +5065,96 @@ static int validate_beacon_tx_rate(struc
+ return 0;
+ }
+
++static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
++ struct net_device *dev,
++ struct nlattr *attrs,
++ struct cfg80211_mbssid_config *config,
++ u8 num_elems)
++{
++ struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
++
++ if (!wiphy->mbssid_max_interfaces)
++ return -EOPNOTSUPP;
++
++ if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
++ NULL) ||
++ !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
++ return -EINVAL;
++
++ config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
++ if (config->ema) {
++ if (!wiphy->ema_max_profile_periodicity)
++ return -EOPNOTSUPP;
++
++ if (num_elems > wiphy->ema_max_profile_periodicity)
++ return -EINVAL;
++ }
++
++ config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
++ if (config->index >= wiphy->mbssid_max_interfaces ||
++ (!config->index && !num_elems))
++ return -EINVAL;
++
++ if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
++ u32 tx_ifindex =
++ nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
++
++ if ((!config->index && tx_ifindex != dev->ifindex) ||
++ (config->index && tx_ifindex == dev->ifindex))
++ return -EINVAL;
++
++ if (tx_ifindex != dev->ifindex) {
++ struct net_device *tx_netdev =
++ dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
++
++ if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
++ tx_netdev->ieee80211_ptr->wiphy != wiphy ||
++ tx_netdev->ieee80211_ptr->iftype !=
++ NL80211_IFTYPE_AP) {
++ dev_put(tx_netdev);
++ return -EINVAL;
++ }
++
++ config->tx_wdev = tx_netdev->ieee80211_ptr;
++ } else {
++ config->tx_wdev = dev->ieee80211_ptr;
++ }
++ } else if (!config->index) {
++ config->tx_wdev = dev->ieee80211_ptr;
++ } else {
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
++static struct cfg80211_mbssid_elems *
++nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
++{
++ struct nlattr *nl_elems;
++ struct cfg80211_mbssid_elems *elems;
++ int rem_elems;
++ u8 i = 0, num_elems = 0;
++
++ if (!wiphy->mbssid_max_interfaces)
++ return ERR_PTR(-EINVAL);
++
++ nla_for_each_nested(nl_elems, attrs, rem_elems)
++ num_elems++;
++
++ elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
++ if (!elems)
++ return ERR_PTR(-ENOMEM);
++
++ nla_for_each_nested(nl_elems, attrs, rem_elems) {
++ elems->elem[i].data = nla_data(nl_elems);
++ elems->elem[i].len = nla_len(nl_elems);
++ i++;
++ }
++ elems->cnt = num_elems;
++ return elems;
++}
++
+ static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
+ struct nlattr *attrs[],
+ struct cfg80211_beacon_data *bcn)
+@@ -5100,6 +5235,17 @@ static int nl80211_parse_beacon(struct c
+ bcn->ftm_responder = -1;
+ }
+
++ if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
++ struct cfg80211_mbssid_elems *mbssid =
++ nl80211_parse_mbssid_elems(&rdev->wiphy,
++ attrs[NL80211_ATTR_MBSSID_ELEMS]);
++
++ if (IS_ERR(mbssid))
++ return PTR_ERR(mbssid);
++
++ bcn->mbssid_ies = mbssid;
++ }
++
+ return 0;
+ }
+
+@@ -5556,6 +5702,17 @@ static int nl80211_start_ap(struct sk_bu
+ goto out;
+ }
+
++ if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
++ err = nl80211_parse_mbssid_config(&rdev->wiphy, dev,
++ info->attrs[NL80211_ATTR_MBSSID_CONFIG],
++ ¶ms.mbssid_config,
++ params.beacon.mbssid_ies ?
++ params.beacon.mbssid_ies->cnt :
++ 0);
++ if (err)
++ goto out;
++ }
++
+ nl80211_calculate_ap_params(¶ms);
+
+ if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
+@@ -5577,6 +5734,11 @@ static int nl80211_start_ap(struct sk_bu
+
+ out:
+ kfree(params.acl);
++ kfree(params.beacon.mbssid_ies);
++ if (params.mbssid_config.tx_wdev &&
++ params.mbssid_config.tx_wdev->netdev &&
++ params.mbssid_config.tx_wdev->netdev != dev)
++ dev_put(params.mbssid_config.tx_wdev->netdev);
+
+ return err;
+ }
+@@ -5601,12 +5763,14 @@ static int nl80211_set_beacon(struct sk_
+
+ err = nl80211_parse_beacon(rdev, info->attrs, ¶ms);
+ if (err)
+- return err;
++ goto out;
+
+ wdev_lock(wdev);
+ err = rdev_change_beacon(rdev, dev, ¶ms);
+ wdev_unlock(wdev);
+
++out:
++ kfree(params.mbssid_ies);
+ return err;
+ }
+
+@@ -9283,12 +9447,14 @@ static int nl80211_channel_switch(struct
+
+ err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after);
+ if (err)
+- return err;
++ goto free;
+
+ csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
+ GFP_KERNEL);
+- if (!csa_attrs)
+- return -ENOMEM;
++ if (!csa_attrs) {
++ err = -ENOMEM;
++ goto free;
++ }
+
+ err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
+ info->attrs[NL80211_ATTR_CSA_IES],
+@@ -9407,6 +9573,8 @@ skip_beacons:
+ wdev_unlock(wdev);
+
+ free:
++ kfree(params.beacon_after.mbssid_ies);
++ kfree(params.beacon_csa.mbssid_ies);
+ kfree(csa_attrs);
+ return err;
+ }
+@@ -14959,6 +15127,8 @@ static int nl80211_color_change(struct s
+ wdev_unlock(wdev);
+
+ out:
++ kfree(params.beacon_next.mbssid_ies);
++ kfree(params.beacon_color_change.mbssid_ies);
+ kfree(tb);
+ return err;
+ }
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/314-v5.17-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/314-v5.17-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch
new file mode 100644
index 0000000..2038ee6
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/314-v5.17-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch
@@ -0,0 +1,378 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 23 Oct 2021 11:10:50 +0200
+Subject: [PATCH] cfg80211: implement APIs for dedicated radar detection HW
+
+If a dedicated (off-channel) radar detection hardware (chain)
+is available in the hardware/driver, allow this to be used by
+calling the NL80211_CMD_RADAR_DETECT command with a new flag
+attribute requesting off-channel radar detection is used.
+
+Offchannel CAC (channel availability check) avoids the CAC
+downtime when switching to a radar channel or when turning on
+the AP.
+
+Drivers advertise support for this using the new feature flag
+NL80211_EXT_FEATURE_RADAR_OFFCHAN.
+
+Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/7468e291ef5d05d692c1738d25b8f778d8ea5c3f.1634979655.git.lorenzo@kernel.org
+Link: https://lore.kernel.org/r/1e60e60fef00e14401adae81c3d49f3e5f307537.1634979655.git.lorenzo@kernel.org
+Link: https://lore.kernel.org/r/85fa50f57fc3adb2934c8d9ca0be30394de6b7e8.1634979655.git.lorenzo@kernel.org
+Link: https://lore.kernel.org/r/4b6c08671ad59aae0ac46fc94c02f31b1610eb72.1634979655.git.lorenzo@kernel.org
+Link: https://lore.kernel.org/r/241849ccaf2c228873c6f8495bf87b19159ba458.1634979655.git.lorenzo@kernel.org
+[remove offchan_mutex, fix cfg80211_stop_offchan_radar_detection(),
+ remove gfp_t argument, fix documentation, fix tracing]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4057,6 +4057,15 @@ struct mgmt_frame_regs {
+ * @set_sar_specs: Update the SAR (TX power) settings.
+ *
+ * @color_change: Initiate a color change.
++ *
++ * @set_radar_offchan: Configure dedicated offchannel chain available for
++ * radar/CAC detection on some hw. This chain can't be used to transmit
++ * or receive frames and it is bounded to a running wdev.
++ * Offchannel radar/CAC detection allows to avoid the CAC downtime
++ * switching to a different channel during CAC detection on the selected
++ * radar channel.
++ * The caller is expected to set chandef pointer to NULL in order to
++ * disable offchannel CAC/radar detection.
+ */
+ struct cfg80211_ops {
+ int (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
+@@ -4387,6 +4396,8 @@ struct cfg80211_ops {
+ int (*color_change)(struct wiphy *wiphy,
+ struct net_device *dev,
+ struct cfg80211_color_change_settings *params);
++ int (*set_radar_offchan)(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef);
+ };
+
+ /*
+@@ -7608,6 +7619,20 @@ void cfg80211_cac_event(struct net_devic
+ const struct cfg80211_chan_def *chandef,
+ enum nl80211_radar_event event, gfp_t gfp);
+
++/**
++ * cfg80211_offchan_cac_event - Channel Availability Check (CAC) offchan event
++ * @wiphy: the wiphy
++ * @chandef: chandef for the current channel
++ * @event: type of event
++ *
++ * This function is called when a Channel Availability Check (CAC) is finished,
++ * started or aborted by a offchannel dedicated chain.
++ *
++ * Note that this acquires the wiphy lock.
++ */
++void cfg80211_offchan_cac_event(struct wiphy *wiphy,
++ const struct cfg80211_chan_def *chandef,
++ enum nl80211_radar_event event);
+
+ /**
+ * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2608,6 +2608,13 @@ enum nl80211_commands {
+ * Mandatory parameter for the transmitting interface to enable MBSSID.
+ * Optional for the non-transmitting interfaces.
+ *
++ * @NL80211_ATTR_RADAR_OFFCHAN: Configure dedicated offchannel chain available for
++ * radar/CAC detection on some hw. This chain can't be used to transmit
++ * or receive frames and it is bounded to a running wdev.
++ * Offchannel radar/CAC detection allows to avoid the CAC downtime
++ * switching on a different channel during CAC detection on the selected
++ * radar channel.
++ *
+ * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+ * @NL80211_ATTR_MAX: highest attribute number currently defined
+ * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3114,6 +3121,8 @@ enum nl80211_attrs {
+ NL80211_ATTR_MBSSID_CONFIG,
+ NL80211_ATTR_MBSSID_ELEMS,
+
++ NL80211_ATTR_RADAR_OFFCHAN,
++
+ /* add attributes here, update the policy in nl80211.c */
+
+ __NL80211_ATTR_AFTER_LAST,
+@@ -6013,6 +6022,9 @@ enum nl80211_feature_flags {
+ * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
+ * detection and change announcemnts.
+ *
++ * @NL80211_EXT_FEATURE_RADAR_OFFCHAN: Device supports offchannel radar/CAC
++ * detection.
++ *
+ * @NUM_NL80211_EXT_FEATURES: number of extended features.
+ * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
+ */
+@@ -6078,6 +6090,7 @@ enum nl80211_ext_feature_index {
+ NL80211_EXT_FEATURE_SECURE_RTT,
+ NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
+ NL80211_EXT_FEATURE_BSS_COLOR,
++ NL80211_EXT_FEATURE_RADAR_OFFCHAN,
+
+ /* add new features before the definition below */
+ NUM_NL80211_EXT_FEATURES,
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -543,6 +543,7 @@ use_default_name:
+ INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work);
+ INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
+ INIT_WORK(&rdev->event_work, cfg80211_event_work);
++ INIT_DELAYED_WORK(&rdev->offchan_cac_work, cfg80211_offchan_cac_work);
+
+ init_waitqueue_head(&rdev->dev_wait);
+
+@@ -1205,6 +1206,8 @@ void __cfg80211_leave(struct cfg80211_re
+
+ cfg80211_pmsr_wdev_down(wdev);
+
++ cfg80211_stop_offchan_radar_detection(wdev);
++
+ switch (wdev->iftype) {
+ case NL80211_IFTYPE_ADHOC:
+ __cfg80211_leave_ibss(rdev, dev, true);
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -84,6 +84,10 @@ struct cfg80211_registered_device {
+
+ struct delayed_work dfs_update_channels_wk;
+
++ struct wireless_dev *offchan_radar_wdev;
++ struct cfg80211_chan_def offchan_radar_chandef;
++ struct delayed_work offchan_cac_work;
++
+ /* netlink port which started critical protocol (0 means not started) */
+ u32 crit_proto_nlportid;
+
+@@ -491,6 +495,15 @@ cfg80211_chandef_dfs_cac_time(struct wip
+
+ void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev);
+
++int
++cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev,
++ struct cfg80211_chan_def *chandef);
++
++void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev);
++
++void cfg80211_offchan_cac_work(struct work_struct *work);
++
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+ struct ieee80211_channel *chan);
+
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -970,3 +970,116 @@ void cfg80211_cac_event(struct net_devic
+ nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
+ }
+ EXPORT_SYMBOL(cfg80211_cac_event);
++
++void cfg80211_offchan_cac_work(struct work_struct *work)
++{
++ struct delayed_work *delayed_work = to_delayed_work(work);
++ struct cfg80211_registered_device *rdev;
++
++ rdev = container_of(delayed_work, struct cfg80211_registered_device,
++ offchan_cac_work);
++ cfg80211_offchan_cac_event(&rdev->wiphy, &rdev->offchan_radar_chandef,
++ NL80211_RADAR_CAC_FINISHED);
++}
++
++static void
++__cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev,
++ const struct cfg80211_chan_def *chandef,
++ enum nl80211_radar_event event)
++{
++ struct wiphy *wiphy = &rdev->wiphy;
++ struct net_device *netdev;
++
++ lockdep_assert_wiphy(&rdev->wiphy);
++
++ if (event != NL80211_RADAR_CAC_STARTED && !rdev->offchan_radar_wdev)
++ return;
++
++ switch (event) {
++ case NL80211_RADAR_CAC_FINISHED:
++ cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
++ memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
++ queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
++ cfg80211_sched_dfs_chan_update(rdev);
++ wdev = rdev->offchan_radar_wdev;
++ rdev->offchan_radar_wdev = NULL;
++ break;
++ case NL80211_RADAR_CAC_ABORTED:
++ cancel_delayed_work(&rdev->offchan_cac_work);
++ wdev = rdev->offchan_radar_wdev;
++ rdev->offchan_radar_wdev = NULL;
++ break;
++ case NL80211_RADAR_CAC_STARTED:
++ WARN_ON(!wdev);
++ rdev->offchan_radar_wdev = wdev;
++ break;
++ default:
++ return;
++ }
++
++ netdev = wdev ? wdev->netdev : NULL;
++ nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL);
++}
++
++void cfg80211_offchan_cac_event(struct wiphy *wiphy,
++ const struct cfg80211_chan_def *chandef,
++ enum nl80211_radar_event event)
++{
++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++
++ wiphy_lock(wiphy);
++ __cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
++ wiphy_unlock(wiphy);
++}
++EXPORT_SYMBOL(cfg80211_offchan_cac_event);
++
++int
++cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev,
++ struct cfg80211_chan_def *chandef)
++{
++ unsigned int cac_time_ms;
++ int err;
++
++ lockdep_assert_wiphy(&rdev->wiphy);
++
++ if (!wiphy_ext_feature_isset(&rdev->wiphy,
++ NL80211_EXT_FEATURE_RADAR_OFFCHAN))
++ return -EOPNOTSUPP;
++
++ if (rdev->offchan_radar_wdev)
++ return -EBUSY;
++
++ err = rdev_set_radar_offchan(rdev, chandef);
++ if (err)
++ return err;
++
++ cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, chandef);
++ if (!cac_time_ms)
++ cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
++
++ rdev->offchan_radar_chandef = *chandef;
++ __cfg80211_offchan_cac_event(rdev, wdev, chandef,
++ NL80211_RADAR_CAC_STARTED);
++ queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_work,
++ msecs_to_jiffies(cac_time_ms));
++
++ return 0;
++}
++
++void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev)
++{
++ struct wiphy *wiphy = wdev->wiphy;
++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++
++ lockdep_assert_wiphy(wiphy);
++
++ if (wdev != rdev->offchan_radar_wdev)
++ return;
++
++ rdev_set_radar_offchan(rdev, NULL);
++
++ __cfg80211_offchan_cac_event(rdev, NULL, NULL,
++ NL80211_RADAR_CAC_ABORTED);
++}
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -801,6 +801,7 @@ static const struct nla_policy nl80211_p
+ [NL80211_ATTR_MBSSID_CONFIG] =
+ NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
+ [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
++ [NL80211_ATTR_RADAR_OFFCHAN] = { .type = NLA_FLAG },
+ };
+
+ /* policy for the key attributes */
+@@ -9287,12 +9288,6 @@ static int nl80211_start_radar_detection
+ if (err)
+ return err;
+
+- if (netif_carrier_ok(dev))
+- return -EBUSY;
+-
+- if (wdev->cac_started)
+- return -EBUSY;
+-
+ err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
+ if (err < 0)
+ return err;
+@@ -9303,6 +9298,16 @@ static int nl80211_start_radar_detection
+ if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
+ return -EINVAL;
+
++ if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN]))
++ return cfg80211_start_offchan_radar_detection(rdev, wdev,
++ &chandef);
++
++ if (netif_carrier_ok(dev))
++ return -EBUSY;
++
++ if (wdev->cac_started)
++ return -EBUSY;
++
+ /* CAC start is offloaded to HW and can't be started manually */
+ if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
+ return -EOPNOTSUPP;
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -1381,4 +1381,21 @@ static inline int rdev_color_change(stru
+ return ret;
+ }
+
++static inline int
++rdev_set_radar_offchan(struct cfg80211_registered_device *rdev,
++ struct cfg80211_chan_def *chandef)
++{
++ struct wiphy *wiphy = &rdev->wiphy;
++ int ret;
++
++ if (!rdev->ops->set_radar_offchan)
++ return -EOPNOTSUPP;
++
++ trace_rdev_set_radar_offchan(wiphy, chandef);
++ ret = rdev->ops->set_radar_offchan(wiphy, chandef);
++ trace_rdev_return_int(wiphy, ret);
++
++ return ret;
++}
++
+ #endif /* __CFG80211_RDEV_OPS */
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3643,6 +3643,25 @@ TRACE_EVENT(cfg80211_bss_color_notify,
+ __entry->color_bitmap)
+ );
+
++TRACE_EVENT(rdev_set_radar_offchan,
++ TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
++
++ TP_ARGS(wiphy, chandef),
++
++ TP_STRUCT__entry(
++ WIPHY_ENTRY
++ CHAN_DEF_ENTRY
++ ),
++
++ TP_fast_assign(
++ WIPHY_ASSIGN;
++ CHAN_DEF_ASSIGN(chandef)
++ ),
++
++ TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
++ WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
++);
++
+ #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
+
+ #undef TRACE_INCLUDE_PATH
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/315-v5.17-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/315-v5.17-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch
new file mode 100644
index 0000000..b1a1d2c
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/315-v5.17-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch
@@ -0,0 +1,183 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 27 Oct 2021 11:03:42 +0200
+Subject: [PATCH] cfg80211: move offchan_cac_event to a dedicated work
+
+In order to make cfg80211_offchan_cac_abort() (renamed from
+cfg80211_offchan_cac_event) callable in other contexts and
+without so much locking restrictions, make it trigger a new
+work instead of operating directly.
+
+Do some other renames while at it to clarify.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/6145c3d0f30400a568023f67981981d24c7c6133.1635325205.git.lorenzo@kernel.org
+[rewrite commit log]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -7620,19 +7620,13 @@ void cfg80211_cac_event(struct net_devic
+ enum nl80211_radar_event event, gfp_t gfp);
+
+ /**
+- * cfg80211_offchan_cac_event - Channel Availability Check (CAC) offchan event
++ * cfg80211_offchan_cac_abort - Channel Availability Check offchan abort event
+ * @wiphy: the wiphy
+- * @chandef: chandef for the current channel
+- * @event: type of event
+ *
+- * This function is called when a Channel Availability Check (CAC) is finished,
+- * started or aborted by a offchannel dedicated chain.
+- *
+- * Note that this acquires the wiphy lock.
++ * This function is called by the driver when a Channel Availability Check
++ * (CAC) is aborted by a offchannel dedicated chain.
+ */
+-void cfg80211_offchan_cac_event(struct wiphy *wiphy,
+- const struct cfg80211_chan_def *chandef,
+- enum nl80211_radar_event event);
++void cfg80211_offchan_cac_abort(struct wiphy *wiphy);
+
+ /**
+ * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -543,7 +543,9 @@ use_default_name:
+ INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work);
+ INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
+ INIT_WORK(&rdev->event_work, cfg80211_event_work);
+- INIT_DELAYED_WORK(&rdev->offchan_cac_work, cfg80211_offchan_cac_work);
++ INIT_WORK(&rdev->offchan_cac_abort_wk, cfg80211_offchan_cac_abort_wk);
++ INIT_DELAYED_WORK(&rdev->offchan_cac_done_wk,
++ cfg80211_offchan_cac_done_wk);
+
+ init_waitqueue_head(&rdev->dev_wait);
+
+@@ -1053,11 +1055,13 @@ void wiphy_unregister(struct wiphy *wiph
+ cancel_work_sync(&rdev->conn_work);
+ flush_work(&rdev->event_work);
+ cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
++ cancel_delayed_work_sync(&rdev->offchan_cac_done_wk);
+ flush_work(&rdev->destroy_work);
+ flush_work(&rdev->sched_scan_stop_wk);
+ flush_work(&rdev->propagate_radar_detect_wk);
+ flush_work(&rdev->propagate_cac_done_wk);
+ flush_work(&rdev->mgmt_registrations_update_wk);
++ flush_work(&rdev->offchan_cac_abort_wk);
+
+ #ifdef CONFIG_PM
+ if (rdev->wiphy.wowlan_config && rdev->ops->set_wakeup)
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -86,7 +86,8 @@ struct cfg80211_registered_device {
+
+ struct wireless_dev *offchan_radar_wdev;
+ struct cfg80211_chan_def offchan_radar_chandef;
+- struct delayed_work offchan_cac_work;
++ struct delayed_work offchan_cac_done_wk;
++ struct work_struct offchan_cac_abort_wk;
+
+ /* netlink port which started critical protocol (0 means not started) */
+ u32 crit_proto_nlportid;
+@@ -502,7 +503,9 @@ cfg80211_start_offchan_radar_detection(s
+
+ void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev);
+
+-void cfg80211_offchan_cac_work(struct work_struct *work);
++void cfg80211_offchan_cac_done_wk(struct work_struct *work);
++
++void cfg80211_offchan_cac_abort_wk(struct work_struct *work);
+
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+ struct ieee80211_channel *chan);
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -971,17 +971,6 @@ void cfg80211_cac_event(struct net_devic
+ }
+ EXPORT_SYMBOL(cfg80211_cac_event);
+
+-void cfg80211_offchan_cac_work(struct work_struct *work)
+-{
+- struct delayed_work *delayed_work = to_delayed_work(work);
+- struct cfg80211_registered_device *rdev;
+-
+- rdev = container_of(delayed_work, struct cfg80211_registered_device,
+- offchan_cac_work);
+- cfg80211_offchan_cac_event(&rdev->wiphy, &rdev->offchan_radar_chandef,
+- NL80211_RADAR_CAC_FINISHED);
+-}
+-
+ static void
+ __cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
+ struct wireless_dev *wdev,
+@@ -1006,7 +995,7 @@ __cfg80211_offchan_cac_event(struct cfg8
+ rdev->offchan_radar_wdev = NULL;
+ break;
+ case NL80211_RADAR_CAC_ABORTED:
+- cancel_delayed_work(&rdev->offchan_cac_work);
++ cancel_delayed_work(&rdev->offchan_cac_done_wk);
+ wdev = rdev->offchan_radar_wdev;
+ rdev->offchan_radar_wdev = NULL;
+ break;
+@@ -1022,17 +1011,44 @@ __cfg80211_offchan_cac_event(struct cfg8
+ nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL);
+ }
+
+-void cfg80211_offchan_cac_event(struct wiphy *wiphy,
+- const struct cfg80211_chan_def *chandef,
+- enum nl80211_radar_event event)
++static void
++cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
++ const struct cfg80211_chan_def *chandef,
++ enum nl80211_radar_event event)
++{
++ wiphy_lock(&rdev->wiphy);
++ __cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
++ wiphy_unlock(&rdev->wiphy);
++}
++
++void cfg80211_offchan_cac_done_wk(struct work_struct *work)
++{
++ struct delayed_work *delayed_work = to_delayed_work(work);
++ struct cfg80211_registered_device *rdev;
++
++ rdev = container_of(delayed_work, struct cfg80211_registered_device,
++ offchan_cac_done_wk);
++ cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
++ NL80211_RADAR_CAC_FINISHED);
++}
++
++void cfg80211_offchan_cac_abort_wk(struct work_struct *work)
++{
++ struct cfg80211_registered_device *rdev;
++
++ rdev = container_of(work, struct cfg80211_registered_device,
++ offchan_cac_abort_wk);
++ cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
++ NL80211_RADAR_CAC_ABORTED);
++}
++
++void cfg80211_offchan_cac_abort(struct wiphy *wiphy)
+ {
+ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+
+- wiphy_lock(wiphy);
+- __cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
+- wiphy_unlock(wiphy);
++ queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
+ }
+-EXPORT_SYMBOL(cfg80211_offchan_cac_event);
++EXPORT_SYMBOL(cfg80211_offchan_cac_abort);
+
+ int
+ cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
+@@ -1062,7 +1078,7 @@ cfg80211_start_offchan_radar_detection(s
+ rdev->offchan_radar_chandef = *chandef;
+ __cfg80211_offchan_cac_event(rdev, wdev, chandef,
+ NL80211_RADAR_CAC_STARTED);
+- queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_work,
++ queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_done_wk,
+ msecs_to_jiffies(cac_time_ms));
+
+ return 0;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/316-v5.17-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/316-v5.17-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch
new file mode 100644
index 0000000..362bb88
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/316-v5.17-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch
@@ -0,0 +1,99 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 3 Nov 2021 18:02:35 +0100
+Subject: [PATCH] cfg80211: fix possible NULL pointer dereference in
+ cfg80211_stop_offchan_radar_detection
+
+Fix the following NULL pointer dereference in
+cfg80211_stop_offchan_radar_detection routine that occurs when hostapd
+is stopped during the CAC on offchannel chain:
+
+Sat Jan 1 0[ 779.567851] ESR = 0x96000005
+0:12:50 2000 dae[ 779.572346] EC = 0x25: DABT (current EL), IL = 32 bits
+mon.debug hostap[ 779.578984] SET = 0, FnV = 0
+d: hostapd_inter[ 779.583445] EA = 0, S1PTW = 0
+face_deinit_free[ 779.587936] Data abort info:
+: num_bss=1 conf[ 779.592224] ISV = 0, ISS = 0x00000005
+->num_bss=1
+Sat[ 779.597403] CM = 0, WnR = 0
+ Jan 1 00:12:50[ 779.601749] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000418b2000
+ 2000 daemon.deb[ 779.609601] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
+ug hostapd: host[ 779.619657] Internal error: Oops: 96000005 [#1] SMP
+[ 779.770810] CPU: 0 PID: 2202 Comm: hostapd Not tainted 5.10.75 #0
+[ 779.776892] Hardware name: MediaTek MT7622 RFB1 board (DT)
+[ 779.782370] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)
+[ 779.788384] pc : cfg80211_chandef_valid+0x10/0x490 [cfg80211]
+[ 779.794128] lr : cfg80211_check_station_change+0x3190/0x3950 [cfg80211]
+[ 779.800731] sp : ffffffc01204b7e0
+[ 779.804036] x29: ffffffc01204b7e0 x28: ffffff80039bdc00
+[ 779.809340] x27: 0000000000000000 x26: ffffffc008cb3050
+[ 779.814644] x25: 0000000000000000 x24: 0000000000000002
+[ 779.819948] x23: ffffff8002630000 x22: ffffff8003e748d0
+[ 779.825252] x21: 0000000000000cc0 x20: ffffff8003da4a00
+[ 779.830556] x19: 0000000000000000 x18: ffffff8001bf7ce0
+[ 779.835860] x17: 00000000ffffffff x16: 0000000000000000
+[ 779.841164] x15: 0000000040d59200 x14: 00000000000019c0
+[ 779.846467] x13: 00000000000001c8 x12: 000636b9e9dab1c6
+[ 779.851771] x11: 0000000000000141 x10: 0000000000000820
+[ 779.857076] x9 : 0000000000000000 x8 : ffffff8003d7d038
+[ 779.862380] x7 : 0000000000000000 x6 : ffffff8003d7d038
+[ 779.867683] x5 : 0000000000000e90 x4 : 0000000000000038
+[ 779.872987] x3 : 0000000000000002 x2 : 0000000000000004
+[ 779.878291] x1 : 0000000000000000 x0 : 0000000000000000
+[ 779.883594] Call trace:
+[ 779.886039] cfg80211_chandef_valid+0x10/0x490 [cfg80211]
+[ 779.891434] cfg80211_check_station_change+0x3190/0x3950 [cfg80211]
+[ 779.897697] nl80211_radar_notify+0x138/0x19c [cfg80211]
+[ 779.903005] cfg80211_stop_offchan_radar_detection+0x7c/0x8c [cfg80211]
+[ 779.909616] __cfg80211_leave+0x2c/0x190 [cfg80211]
+[ 779.914490] cfg80211_register_netdevice+0x1c0/0x6d0 [cfg80211]
+[ 779.920404] raw_notifier_call_chain+0x50/0x70
+[ 779.924841] call_netdevice_notifiers_info+0x54/0xa0
+[ 779.929796] __dev_close_many+0x40/0x100
+[ 779.933712] __dev_change_flags+0x98/0x190
+[ 779.937800] dev_change_flags+0x20/0x60
+[ 779.941628] devinet_ioctl+0x534/0x6d0
+[ 779.945370] inet_ioctl+0x1bc/0x230
+[ 779.948849] sock_do_ioctl+0x44/0x200
+[ 779.952502] sock_ioctl+0x268/0x4c0
+[ 779.955985] __arm64_sys_ioctl+0xac/0xd0
+[ 779.959900] el0_svc_common.constprop.0+0x60/0x110
+[ 779.964682] do_el0_svc+0x1c/0x24
+[ 779.967990] el0_svc+0x10/0x1c
+[ 779.971036] el0_sync_handler+0x9c/0x120
+[ 779.974950] el0_sync+0x148/0x180
+[ 779.978259] Code: a9bc7bfd 910003fd a90153f3 aa0003f3 (f9400000)
+[ 779.984344] ---[ end trace 0e67b4f5d6cdeec7 ]---
+[ 779.996400] Kernel panic - not syncing: Oops: Fatal exception
+[ 780.002139] SMP: stopping secondary CPUs
+[ 780.006057] Kernel Offset: disabled
+[ 780.009537] CPU features: 0x0000002,04002004
+[ 780.013796] Memory Limit: none
+
+Fixes: b8f5facf286b ("cfg80211: implement APIs for dedicated radar detection HW")
+Reported-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/c2e34c065bf8839c5ffa45498ae154021a72a520.1635958796.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -982,6 +982,9 @@ __cfg80211_offchan_cac_event(struct cfg8
+
+ lockdep_assert_wiphy(&rdev->wiphy);
+
++ if (!cfg80211_chandef_valid(chandef))
++ return;
++
+ if (event != NL80211_RADAR_CAC_STARTED && !rdev->offchan_radar_wdev)
+ return;
+
+@@ -1096,6 +1099,6 @@ void cfg80211_stop_offchan_radar_detecti
+
+ rdev_set_radar_offchan(rdev, NULL);
+
+- __cfg80211_offchan_cac_event(rdev, NULL, NULL,
++ __cfg80211_offchan_cac_event(rdev, wdev, &rdev->offchan_radar_chandef,
+ NL80211_RADAR_CAC_ABORTED);
+ }
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/317-v5.17-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/317-v5.17-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch
new file mode 100644
index 0000000..df7afef
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/317-v5.17-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch
@@ -0,0 +1,136 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 16 Nov 2021 12:41:52 +0100
+Subject: [PATCH] cfg80211: schedule offchan_cac_abort_wk in
+ cfg80211_radar_event
+
+If necessary schedule offchan_cac_abort_wk work in cfg80211_radar_event
+routine adding offchan parameter to cfg80211_radar_event signature.
+Rename cfg80211_radar_event in __cfg80211_radar_event and introduce
+the two following inline helpers:
+- cfg80211_radar_event
+- cfg80211_offchan_radar_event
+Doing so the drv will not need to run cfg80211_offchan_cac_abort() after
+radar detection on the offchannel chain.
+
+Tested-by: Owen Peng <owen.peng@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/3ff583e021e3343a3ced54a7b09b5e184d1880dc.1637062727.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -7580,15 +7580,33 @@ void cfg80211_cqm_txe_notify(struct net_
+ void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp);
+
+ /**
+- * cfg80211_radar_event - radar detection event
++ * __cfg80211_radar_event - radar detection event
+ * @wiphy: the wiphy
+ * @chandef: chandef for the current channel
++ * @offchan: the radar has been detected on the offchannel chain
+ * @gfp: context flags
+ *
+ * This function is called when a radar is detected on the current chanenl.
+ */
+-void cfg80211_radar_event(struct wiphy *wiphy,
+- struct cfg80211_chan_def *chandef, gfp_t gfp);
++void __cfg80211_radar_event(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef,
++ bool offchan, gfp_t gfp);
++
++static inline void
++cfg80211_radar_event(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef,
++ gfp_t gfp)
++{
++ __cfg80211_radar_event(wiphy, chandef, false, gfp);
++}
++
++static inline void
++cfg80211_offchan_radar_event(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef,
++ gfp_t gfp)
++{
++ __cfg80211_radar_event(wiphy, chandef, true, gfp);
++}
+
+ /**
+ * cfg80211_sta_opmode_change_notify - STA's ht/vht operation mode change event
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -905,13 +905,13 @@ void cfg80211_dfs_channels_update_work(s
+ }
+
+
+-void cfg80211_radar_event(struct wiphy *wiphy,
+- struct cfg80211_chan_def *chandef,
+- gfp_t gfp)
++void __cfg80211_radar_event(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef,
++ bool offchan, gfp_t gfp)
+ {
+ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+
+- trace_cfg80211_radar_event(wiphy, chandef);
++ trace_cfg80211_radar_event(wiphy, chandef, offchan);
+
+ /* only set the chandef supplied channel to unavailable, in
+ * case the radar is detected on only one of multiple channels
+@@ -919,6 +919,9 @@ void cfg80211_radar_event(struct wiphy *
+ */
+ cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
+
++ if (offchan)
++ queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
++
+ cfg80211_sched_dfs_chan_update(rdev);
+
+ nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
+@@ -926,7 +929,7 @@ void cfg80211_radar_event(struct wiphy *
+ memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def));
+ queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
+ }
+-EXPORT_SYMBOL(cfg80211_radar_event);
++EXPORT_SYMBOL(__cfg80211_radar_event);
+
+ void cfg80211_cac_event(struct net_device *netdev,
+ const struct cfg80211_chan_def *chandef,
+@@ -998,7 +1001,8 @@ __cfg80211_offchan_cac_event(struct cfg8
+ rdev->offchan_radar_wdev = NULL;
+ break;
+ case NL80211_RADAR_CAC_ABORTED:
+- cancel_delayed_work(&rdev->offchan_cac_done_wk);
++ if (!cancel_delayed_work(&rdev->offchan_cac_done_wk))
++ return;
+ wdev = rdev->offchan_radar_wdev;
+ rdev->offchan_radar_wdev = NULL;
+ break;
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3022,18 +3022,21 @@ TRACE_EVENT(cfg80211_ch_switch_started_n
+ );
+
+ TRACE_EVENT(cfg80211_radar_event,
+- TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
+- TP_ARGS(wiphy, chandef),
++ TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef,
++ bool offchan),
++ TP_ARGS(wiphy, chandef, offchan),
+ TP_STRUCT__entry(
+ WIPHY_ENTRY
+ CHAN_DEF_ENTRY
++ __field(bool, offchan)
+ ),
+ TP_fast_assign(
+ WIPHY_ASSIGN;
+ CHAN_DEF_ASSIGN(chandef);
++ __entry->offchan = offchan;
+ ),
+- TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
+- WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
++ TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT ", offchan %d",
++ WIPHY_PR_ARG, CHAN_DEF_PR_ARG, __entry->offchan)
+ );
+
+ TRACE_EVENT(cfg80211_cac_event,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/318-v5.17-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/318-v5.17-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch
new file mode 100644
index 0000000..a1b6e3c
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/318-v5.17-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch
@@ -0,0 +1,220 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 16 Nov 2021 15:03:36 +0100
+Subject: [PATCH] cfg80211: allow continuous radar monitoring on offchannel
+ chain
+
+Allow continuous radar detection on the offchannel chain in order
+to switch to the monitored channel whenever the underlying driver
+reports a radar pattern on the main channel.
+
+Tested-by: Owen Peng <owen.peng@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/d46217310a49b14ff0e9c002f0a6e0547d70fd2c.1637071350.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -712,6 +712,19 @@ static bool cfg80211_is_wiphy_oper_chan(
+ return false;
+ }
+
++static bool
++cfg80211_offchan_chain_is_active(struct cfg80211_registered_device *rdev,
++ struct ieee80211_channel *channel)
++{
++ if (!rdev->offchan_radar_wdev)
++ return false;
++
++ if (!cfg80211_chandef_valid(&rdev->offchan_radar_chandef))
++ return false;
++
++ return cfg80211_is_sub_chan(&rdev->offchan_radar_chandef, channel);
++}
++
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+ struct ieee80211_channel *chan)
+ {
+@@ -728,6 +741,9 @@ bool cfg80211_any_wiphy_oper_chan(struct
+
+ if (cfg80211_is_wiphy_oper_chan(&rdev->wiphy, chan))
+ return true;
++
++ if (cfg80211_offchan_chain_is_active(rdev, chan))
++ return true;
+ }
+
+ return false;
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -988,7 +988,7 @@ __cfg80211_offchan_cac_event(struct cfg8
+ if (!cfg80211_chandef_valid(chandef))
+ return;
+
+- if (event != NL80211_RADAR_CAC_STARTED && !rdev->offchan_radar_wdev)
++ if (!rdev->offchan_radar_wdev)
+ return;
+
+ switch (event) {
+@@ -998,17 +998,13 @@ __cfg80211_offchan_cac_event(struct cfg8
+ queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
+ cfg80211_sched_dfs_chan_update(rdev);
+ wdev = rdev->offchan_radar_wdev;
+- rdev->offchan_radar_wdev = NULL;
+ break;
+ case NL80211_RADAR_CAC_ABORTED:
+ if (!cancel_delayed_work(&rdev->offchan_cac_done_wk))
+ return;
+ wdev = rdev->offchan_radar_wdev;
+- rdev->offchan_radar_wdev = NULL;
+ break;
+ case NL80211_RADAR_CAC_STARTED:
+- WARN_ON(!wdev);
+- rdev->offchan_radar_wdev = wdev;
+ break;
+ default:
+ return;
+@@ -1024,7 +1020,8 @@ cfg80211_offchan_cac_event(struct cfg802
+ enum nl80211_radar_event event)
+ {
+ wiphy_lock(&rdev->wiphy);
+- __cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
++ __cfg80211_offchan_cac_event(rdev, rdev->offchan_radar_wdev,
++ chandef, event);
+ wiphy_unlock(&rdev->wiphy);
+ }
+
+@@ -1071,7 +1068,13 @@ cfg80211_start_offchan_radar_detection(s
+ NL80211_EXT_FEATURE_RADAR_OFFCHAN))
+ return -EOPNOTSUPP;
+
+- if (rdev->offchan_radar_wdev)
++ /* Offchannel chain already locked by another wdev */
++ if (rdev->offchan_radar_wdev && rdev->offchan_radar_wdev != wdev)
++ return -EBUSY;
++
++ /* CAC already in progress on the offchannel chain */
++ if (rdev->offchan_radar_wdev == wdev &&
++ delayed_work_pending(&rdev->offchan_cac_done_wk))
+ return -EBUSY;
+
+ err = rdev_set_radar_offchan(rdev, chandef);
+@@ -1083,6 +1086,8 @@ cfg80211_start_offchan_radar_detection(s
+ cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+
+ rdev->offchan_radar_chandef = *chandef;
++ rdev->offchan_radar_wdev = wdev; /* Get offchain ownership */
++
+ __cfg80211_offchan_cac_event(rdev, wdev, chandef,
+ NL80211_RADAR_CAC_STARTED);
+ queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_done_wk,
+@@ -1102,6 +1107,7 @@ void cfg80211_stop_offchan_radar_detecti
+ return;
+
+ rdev_set_radar_offchan(rdev, NULL);
++ rdev->offchan_radar_wdev = NULL; /* Release offchain ownership */
+
+ __cfg80211_offchan_cac_event(rdev, wdev, &rdev->offchan_radar_chandef,
+ NL80211_RADAR_CAC_ABORTED);
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -9278,42 +9278,60 @@ static int nl80211_start_radar_detection
+ struct cfg80211_chan_def chandef;
+ enum nl80211_dfs_regions dfs_region;
+ unsigned int cac_time_ms;
+- int err;
++ int err = -EINVAL;
++
++ flush_delayed_work(&rdev->dfs_update_channels_wk);
++
++ wiphy_lock(wiphy);
+
+ dfs_region = reg_get_dfs_region(wiphy);
+ if (dfs_region == NL80211_DFS_UNSET)
+- return -EINVAL;
++ goto unlock;
+
+ err = nl80211_parse_chandef(rdev, info, &chandef);
+ if (err)
+- return err;
++ goto unlock;
+
+ err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
+ if (err < 0)
+- return err;
++ goto unlock;
+
+- if (err == 0)
+- return -EINVAL;
++ if (err == 0) {
++ err = -EINVAL;
++ goto unlock;
++ }
+
+- if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
+- return -EINVAL;
++ if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) {
++ err = -EINVAL;
++ goto unlock;
++ }
+
+- if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN]))
+- return cfg80211_start_offchan_radar_detection(rdev, wdev,
+- &chandef);
++ if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN])) {
++ err = cfg80211_start_offchan_radar_detection(rdev, wdev,
++ &chandef);
++ goto unlock;
++ }
+
+- if (netif_carrier_ok(dev))
+- return -EBUSY;
++ if (netif_carrier_ok(dev)) {
++ err = -EBUSY;
++ goto unlock;
++ }
+
+- if (wdev->cac_started)
+- return -EBUSY;
++ if (wdev->cac_started) {
++ err = -EBUSY;
++ goto unlock;
++ }
+
+ /* CAC start is offloaded to HW and can't be started manually */
+- if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
+- return -EOPNOTSUPP;
++ if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) {
++ err = -EOPNOTSUPP;
++ goto unlock;
++ }
+
+- if (!rdev->ops->start_radar_detection)
+- return -EOPNOTSUPP;
++ if (!rdev->ops->start_radar_detection) {
++ err = -EOPNOTSUPP;
++ goto unlock;
++ }
+
+ cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
+ if (WARN_ON(!cac_time_ms))
+@@ -9326,6 +9344,9 @@ static int nl80211_start_radar_detection
+ wdev->cac_start_time = jiffies;
+ wdev->cac_time_ms = cac_time_ms;
+ }
++unlock:
++ wiphy_unlock(wiphy);
++
+ return err;
+ }
+
+@@ -15961,7 +15982,8 @@ static const struct genl_small_ops nl802
+ .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .doit = nl80211_start_radar_detection,
+ .flags = GENL_UNS_ADMIN_PERM,
+- .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
++ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
++ NL80211_FLAG_NO_WIPHY_MTX,
+ },
+ {
+ .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-v5.17-mac80211-introduce-set_radar_offchan-callback.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-v5.17-mac80211-introduce-set_radar_offchan-callback.patch
new file mode 100644
index 0000000..6197abd
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-v5.17-mac80211-introduce-set_radar_offchan-callback.patch
@@ -0,0 +1,67 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 23 Oct 2021 11:10:51 +0200
+Subject: [PATCH] mac80211: introduce set_radar_offchan callback
+
+Similar to cfg80211, introduce set_radar_offchan callback in mac80211_ops
+in order to configure a dedicated offchannel chain available on some hw
+(e.g. mt7915) to perform offchannel CAC detection and avoid tx/rx downtime.
+
+Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/201110606d4f3a7dfdf31440e351f2e2c375d4f0.1634979655.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -3937,6 +3937,14 @@ struct ieee80211_prep_tx_info {
+ * twt structure.
+ * @twt_teardown_request: Update the hw with TWT teardown request received
+ * from the peer.
++ * @set_radar_offchan: Configure dedicated offchannel chain available for
++ * radar/CAC detection on some hw. This chain can't be used to transmit
++ * or receive frames and it is bounded to a running wdev.
++ * Offchannel radar/CAC detection allows to avoid the CAC downtime
++ * switching to a different channel during CAC detection on the selected
++ * radar channel.
++ * The caller is expected to set chandef pointer to NULL in order to
++ * disable offchannel CAC/radar detection.
+ * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
+ * resolve a path for hardware flow offloading
+ */
+@@ -4267,6 +4275,8 @@ struct ieee80211_ops {
+ struct ieee80211_twt_setup *twt);
+ void (*twt_teardown_request)(struct ieee80211_hw *hw,
+ struct ieee80211_sta *sta, u8 flowid);
++ int (*set_radar_offchan)(struct ieee80211_hw *hw,
++ struct cfg80211_chan_def *chandef);
+ #if LINUX_VERSION_IS_GEQ(5,10,0)
+ int (*net_fill_forward_path)(struct ieee80211_hw *hw,
+ struct ieee80211_vif *vif,
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4341,6 +4341,18 @@ out:
+ return err;
+ }
+
++static int
++ieee80211_set_radar_offchan(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef)
++{
++ struct ieee80211_local *local = wiphy_priv(wiphy);
++
++ if (!local->ops->set_radar_offchan)
++ return -EOPNOTSUPP;
++
++ return local->ops->set_radar_offchan(&local->hw, chandef);
++}
++
+ const struct cfg80211_ops mac80211_config_ops = {
+ .add_virtual_intf = ieee80211_add_iface,
+ .del_virtual_intf = ieee80211_del_iface,
+@@ -4445,4 +4457,5 @@ const struct cfg80211_ops mac80211_confi
+ .reset_tid_config = ieee80211_reset_tid_config,
+ .set_sar_specs = ieee80211_set_sar_specs,
+ .color_change = ieee80211_color_change,
++ .set_radar_offchan = ieee80211_set_radar_offchan,
+ };
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-v5.17-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-v5.17-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch
new file mode 100644
index 0000000..608e724
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-v5.17-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch
@@ -0,0 +1,532 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 29 Nov 2021 14:11:24 +0100
+Subject: [PATCH] cfg80211: rename offchannel_chain structs to background_chain
+ to avoid confusion with ETSI standard
+
+ETSI standard defines "Offchannel CAC" as:
+"Off-Channel CAC is performed by a number of non-continuous checks
+spread over a period in time. This period, which is required to
+determine the presence of radar signals, is defined as the Off-Channel
+CAC Time..
+Minimum Off-Channel CAC Time 6 minutes and Maximum Off-Channel CAC Time
+4 hours..".
+mac80211 implementation refers to a dedicated hw chain used for continuous
+radar monitoring. Rename offchannel_* references to background_* in
+order to avoid confusion with ETSI standard.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/4204cc1d648d76b44557981713231e030a3bd991.1638190762.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4058,14 +4058,14 @@ struct mgmt_frame_regs {
+ *
+ * @color_change: Initiate a color change.
+ *
+- * @set_radar_offchan: Configure dedicated offchannel chain available for
++ * @set_radar_background: Configure dedicated offchannel chain available for
+ * radar/CAC detection on some hw. This chain can't be used to transmit
+ * or receive frames and it is bounded to a running wdev.
+- * Offchannel radar/CAC detection allows to avoid the CAC downtime
++ * Background radar/CAC detection allows to avoid the CAC downtime
+ * switching to a different channel during CAC detection on the selected
+ * radar channel.
+ * The caller is expected to set chandef pointer to NULL in order to
+- * disable offchannel CAC/radar detection.
++ * disable background CAC/radar detection.
+ */
+ struct cfg80211_ops {
+ int (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
+@@ -4396,8 +4396,8 @@ struct cfg80211_ops {
+ int (*color_change)(struct wiphy *wiphy,
+ struct net_device *dev,
+ struct cfg80211_color_change_settings *params);
+- int (*set_radar_offchan)(struct wiphy *wiphy,
+- struct cfg80211_chan_def *chandef);
++ int (*set_radar_background)(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef);
+ };
+
+ /*
+@@ -7601,9 +7601,9 @@ cfg80211_radar_event(struct wiphy *wiphy
+ }
+
+ static inline void
+-cfg80211_offchan_radar_event(struct wiphy *wiphy,
+- struct cfg80211_chan_def *chandef,
+- gfp_t gfp)
++cfg80211_background_radar_event(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef,
++ gfp_t gfp)
+ {
+ __cfg80211_radar_event(wiphy, chandef, true, gfp);
+ }
+@@ -7638,13 +7638,13 @@ void cfg80211_cac_event(struct net_devic
+ enum nl80211_radar_event event, gfp_t gfp);
+
+ /**
+- * cfg80211_offchan_cac_abort - Channel Availability Check offchan abort event
++ * cfg80211_background_cac_abort - Channel Availability Check offchan abort event
+ * @wiphy: the wiphy
+ *
+ * This function is called by the driver when a Channel Availability Check
+ * (CAC) is aborted by a offchannel dedicated chain.
+ */
+-void cfg80211_offchan_cac_abort(struct wiphy *wiphy);
++void cfg80211_background_cac_abort(struct wiphy *wiphy);
+
+ /**
+ * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -3937,14 +3937,14 @@ struct ieee80211_prep_tx_info {
+ * twt structure.
+ * @twt_teardown_request: Update the hw with TWT teardown request received
+ * from the peer.
+- * @set_radar_offchan: Configure dedicated offchannel chain available for
++ * @set_radar_background: Configure dedicated offchannel chain available for
+ * radar/CAC detection on some hw. This chain can't be used to transmit
+ * or receive frames and it is bounded to a running wdev.
+- * Offchannel radar/CAC detection allows to avoid the CAC downtime
++ * Background radar/CAC detection allows to avoid the CAC downtime
+ * switching to a different channel during CAC detection on the selected
+ * radar channel.
+ * The caller is expected to set chandef pointer to NULL in order to
+- * disable offchannel CAC/radar detection.
++ * disable background CAC/radar detection.
+ * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
+ * resolve a path for hardware flow offloading
+ */
+@@ -4275,8 +4275,8 @@ struct ieee80211_ops {
+ struct ieee80211_twt_setup *twt);
+ void (*twt_teardown_request)(struct ieee80211_hw *hw,
+ struct ieee80211_sta *sta, u8 flowid);
+- int (*set_radar_offchan)(struct ieee80211_hw *hw,
+- struct cfg80211_chan_def *chandef);
++ int (*set_radar_background)(struct ieee80211_hw *hw,
++ struct cfg80211_chan_def *chandef);
+ #if LINUX_VERSION_IS_GEQ(5,10,0)
+ int (*net_fill_forward_path)(struct ieee80211_hw *hw,
+ struct ieee80211_vif *vif,
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2608,10 +2608,10 @@ enum nl80211_commands {
+ * Mandatory parameter for the transmitting interface to enable MBSSID.
+ * Optional for the non-transmitting interfaces.
+ *
+- * @NL80211_ATTR_RADAR_OFFCHAN: Configure dedicated offchannel chain available for
+- * radar/CAC detection on some hw. This chain can't be used to transmit
+- * or receive frames and it is bounded to a running wdev.
+- * Offchannel radar/CAC detection allows to avoid the CAC downtime
++ * @NL80211_ATTR_RADAR_BACKGROUND: Configure dedicated offchannel chain
++ * available for radar/CAC detection on some hw. This chain can't be used
++ * to transmit or receive frames and it is bounded to a running wdev.
++ * Background radar/CAC detection allows to avoid the CAC downtime
+ * switching on a different channel during CAC detection on the selected
+ * radar channel.
+ *
+@@ -3121,7 +3121,7 @@ enum nl80211_attrs {
+ NL80211_ATTR_MBSSID_CONFIG,
+ NL80211_ATTR_MBSSID_ELEMS,
+
+- NL80211_ATTR_RADAR_OFFCHAN,
++ NL80211_ATTR_RADAR_BACKGROUND,
+
+ /* add attributes here, update the policy in nl80211.c */
+
+@@ -6022,7 +6022,7 @@ enum nl80211_feature_flags {
+ * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
+ * detection and change announcemnts.
+ *
+- * @NL80211_EXT_FEATURE_RADAR_OFFCHAN: Device supports offchannel radar/CAC
++ * @NL80211_EXT_FEATURE_RADAR_BACKGROUND: Device supports background radar/CAC
+ * detection.
+ *
+ * @NUM_NL80211_EXT_FEATURES: number of extended features.
+@@ -6090,7 +6090,7 @@ enum nl80211_ext_feature_index {
+ NL80211_EXT_FEATURE_SECURE_RTT,
+ NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
+ NL80211_EXT_FEATURE_BSS_COLOR,
+- NL80211_EXT_FEATURE_RADAR_OFFCHAN,
++ NL80211_EXT_FEATURE_RADAR_BACKGROUND,
+
+ /* add new features before the definition below */
+ NUM_NL80211_EXT_FEATURES,
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4342,15 +4342,15 @@ out:
+ }
+
+ static int
+-ieee80211_set_radar_offchan(struct wiphy *wiphy,
+- struct cfg80211_chan_def *chandef)
++ieee80211_set_radar_background(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef)
+ {
+ struct ieee80211_local *local = wiphy_priv(wiphy);
+
+- if (!local->ops->set_radar_offchan)
++ if (!local->ops->set_radar_background)
+ return -EOPNOTSUPP;
+
+- return local->ops->set_radar_offchan(&local->hw, chandef);
++ return local->ops->set_radar_background(&local->hw, chandef);
+ }
+
+ const struct cfg80211_ops mac80211_config_ops = {
+@@ -4457,5 +4457,5 @@ const struct cfg80211_ops mac80211_confi
+ .reset_tid_config = ieee80211_reset_tid_config,
+ .set_sar_specs = ieee80211_set_sar_specs,
+ .color_change = ieee80211_color_change,
+- .set_radar_offchan = ieee80211_set_radar_offchan,
++ .set_radar_background = ieee80211_set_radar_background,
+ };
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -716,13 +716,13 @@ static bool
+ cfg80211_offchan_chain_is_active(struct cfg80211_registered_device *rdev,
+ struct ieee80211_channel *channel)
+ {
+- if (!rdev->offchan_radar_wdev)
++ if (!rdev->background_radar_wdev)
+ return false;
+
+- if (!cfg80211_chandef_valid(&rdev->offchan_radar_chandef))
++ if (!cfg80211_chandef_valid(&rdev->background_radar_chandef))
+ return false;
+
+- return cfg80211_is_sub_chan(&rdev->offchan_radar_chandef, channel);
++ return cfg80211_is_sub_chan(&rdev->background_radar_chandef, channel);
+ }
+
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -543,9 +543,10 @@ use_default_name:
+ INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work);
+ INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
+ INIT_WORK(&rdev->event_work, cfg80211_event_work);
+- INIT_WORK(&rdev->offchan_cac_abort_wk, cfg80211_offchan_cac_abort_wk);
+- INIT_DELAYED_WORK(&rdev->offchan_cac_done_wk,
+- cfg80211_offchan_cac_done_wk);
++ INIT_WORK(&rdev->background_cac_abort_wk,
++ cfg80211_background_cac_abort_wk);
++ INIT_DELAYED_WORK(&rdev->background_cac_done_wk,
++ cfg80211_background_cac_done_wk);
+
+ init_waitqueue_head(&rdev->dev_wait);
+
+@@ -1055,13 +1056,13 @@ void wiphy_unregister(struct wiphy *wiph
+ cancel_work_sync(&rdev->conn_work);
+ flush_work(&rdev->event_work);
+ cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
+- cancel_delayed_work_sync(&rdev->offchan_cac_done_wk);
++ cancel_delayed_work_sync(&rdev->background_cac_done_wk);
+ flush_work(&rdev->destroy_work);
+ flush_work(&rdev->sched_scan_stop_wk);
+ flush_work(&rdev->propagate_radar_detect_wk);
+ flush_work(&rdev->propagate_cac_done_wk);
+ flush_work(&rdev->mgmt_registrations_update_wk);
+- flush_work(&rdev->offchan_cac_abort_wk);
++ flush_work(&rdev->background_cac_abort_wk);
+
+ #ifdef CONFIG_PM
+ if (rdev->wiphy.wowlan_config && rdev->ops->set_wakeup)
+@@ -1210,7 +1211,7 @@ void __cfg80211_leave(struct cfg80211_re
+
+ cfg80211_pmsr_wdev_down(wdev);
+
+- cfg80211_stop_offchan_radar_detection(wdev);
++ cfg80211_stop_background_radar_detection(wdev);
+
+ switch (wdev->iftype) {
+ case NL80211_IFTYPE_ADHOC:
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -84,10 +84,10 @@ struct cfg80211_registered_device {
+
+ struct delayed_work dfs_update_channels_wk;
+
+- struct wireless_dev *offchan_radar_wdev;
+- struct cfg80211_chan_def offchan_radar_chandef;
+- struct delayed_work offchan_cac_done_wk;
+- struct work_struct offchan_cac_abort_wk;
++ struct wireless_dev *background_radar_wdev;
++ struct cfg80211_chan_def background_radar_chandef;
++ struct delayed_work background_cac_done_wk;
++ struct work_struct background_cac_abort_wk;
+
+ /* netlink port which started critical protocol (0 means not started) */
+ u32 crit_proto_nlportid;
+@@ -497,15 +497,15 @@ cfg80211_chandef_dfs_cac_time(struct wip
+ void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev);
+
+ int
+-cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
+- struct wireless_dev *wdev,
+- struct cfg80211_chan_def *chandef);
++cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev,
++ struct cfg80211_chan_def *chandef);
+
+-void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev);
++void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev);
+
+-void cfg80211_offchan_cac_done_wk(struct work_struct *work);
++void cfg80211_background_cac_done_wk(struct work_struct *work);
+
+-void cfg80211_offchan_cac_abort_wk(struct work_struct *work);
++void cfg80211_background_cac_abort_wk(struct work_struct *work);
+
+ bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
+ struct ieee80211_channel *chan);
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -920,7 +920,7 @@ void __cfg80211_radar_event(struct wiphy
+ cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
+
+ if (offchan)
+- queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
++ queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
+
+ cfg80211_sched_dfs_chan_update(rdev);
+
+@@ -975,10 +975,10 @@ void cfg80211_cac_event(struct net_devic
+ EXPORT_SYMBOL(cfg80211_cac_event);
+
+ static void
+-__cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
+- struct wireless_dev *wdev,
+- const struct cfg80211_chan_def *chandef,
+- enum nl80211_radar_event event)
++__cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev,
++ const struct cfg80211_chan_def *chandef,
++ enum nl80211_radar_event event)
+ {
+ struct wiphy *wiphy = &rdev->wiphy;
+ struct net_device *netdev;
+@@ -988,7 +988,7 @@ __cfg80211_offchan_cac_event(struct cfg8
+ if (!cfg80211_chandef_valid(chandef))
+ return;
+
+- if (!rdev->offchan_radar_wdev)
++ if (!rdev->background_radar_wdev)
+ return;
+
+ switch (event) {
+@@ -997,12 +997,12 @@ __cfg80211_offchan_cac_event(struct cfg8
+ memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
+ queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
+ cfg80211_sched_dfs_chan_update(rdev);
+- wdev = rdev->offchan_radar_wdev;
++ wdev = rdev->background_radar_wdev;
+ break;
+ case NL80211_RADAR_CAC_ABORTED:
+- if (!cancel_delayed_work(&rdev->offchan_cac_done_wk))
++ if (!cancel_delayed_work(&rdev->background_cac_done_wk))
+ return;
+- wdev = rdev->offchan_radar_wdev;
++ wdev = rdev->background_radar_wdev;
+ break;
+ case NL80211_RADAR_CAC_STARTED:
+ break;
+@@ -1015,49 +1015,49 @@ __cfg80211_offchan_cac_event(struct cfg8
+ }
+
+ static void
+-cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
+- const struct cfg80211_chan_def *chandef,
+- enum nl80211_radar_event event)
++cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
++ const struct cfg80211_chan_def *chandef,
++ enum nl80211_radar_event event)
+ {
+ wiphy_lock(&rdev->wiphy);
+- __cfg80211_offchan_cac_event(rdev, rdev->offchan_radar_wdev,
+- chandef, event);
++ __cfg80211_background_cac_event(rdev, rdev->background_radar_wdev,
++ chandef, event);
+ wiphy_unlock(&rdev->wiphy);
+ }
+
+-void cfg80211_offchan_cac_done_wk(struct work_struct *work)
++void cfg80211_background_cac_done_wk(struct work_struct *work)
+ {
+ struct delayed_work *delayed_work = to_delayed_work(work);
+ struct cfg80211_registered_device *rdev;
+
+ rdev = container_of(delayed_work, struct cfg80211_registered_device,
+- offchan_cac_done_wk);
+- cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
+- NL80211_RADAR_CAC_FINISHED);
++ background_cac_done_wk);
++ cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
++ NL80211_RADAR_CAC_FINISHED);
+ }
+
+-void cfg80211_offchan_cac_abort_wk(struct work_struct *work)
++void cfg80211_background_cac_abort_wk(struct work_struct *work)
+ {
+ struct cfg80211_registered_device *rdev;
+
+ rdev = container_of(work, struct cfg80211_registered_device,
+- offchan_cac_abort_wk);
+- cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
+- NL80211_RADAR_CAC_ABORTED);
++ background_cac_abort_wk);
++ cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
++ NL80211_RADAR_CAC_ABORTED);
+ }
+
+-void cfg80211_offchan_cac_abort(struct wiphy *wiphy)
++void cfg80211_background_cac_abort(struct wiphy *wiphy)
+ {
+ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+
+- queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
++ queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
+ }
+-EXPORT_SYMBOL(cfg80211_offchan_cac_abort);
++EXPORT_SYMBOL(cfg80211_background_cac_abort);
+
+ int
+-cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
+- struct wireless_dev *wdev,
+- struct cfg80211_chan_def *chandef)
++cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev,
++ struct cfg80211_chan_def *chandef)
+ {
+ unsigned int cac_time_ms;
+ int err;
+@@ -1065,19 +1065,19 @@ cfg80211_start_offchan_radar_detection(s
+ lockdep_assert_wiphy(&rdev->wiphy);
+
+ if (!wiphy_ext_feature_isset(&rdev->wiphy,
+- NL80211_EXT_FEATURE_RADAR_OFFCHAN))
++ NL80211_EXT_FEATURE_RADAR_BACKGROUND))
+ return -EOPNOTSUPP;
+
+ /* Offchannel chain already locked by another wdev */
+- if (rdev->offchan_radar_wdev && rdev->offchan_radar_wdev != wdev)
++ if (rdev->background_radar_wdev && rdev->background_radar_wdev != wdev)
+ return -EBUSY;
+
+ /* CAC already in progress on the offchannel chain */
+- if (rdev->offchan_radar_wdev == wdev &&
+- delayed_work_pending(&rdev->offchan_cac_done_wk))
++ if (rdev->background_radar_wdev == wdev &&
++ delayed_work_pending(&rdev->background_cac_done_wk))
+ return -EBUSY;
+
+- err = rdev_set_radar_offchan(rdev, chandef);
++ err = rdev_set_radar_background(rdev, chandef);
+ if (err)
+ return err;
+
+@@ -1085,30 +1085,31 @@ cfg80211_start_offchan_radar_detection(s
+ if (!cac_time_ms)
+ cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+
+- rdev->offchan_radar_chandef = *chandef;
+- rdev->offchan_radar_wdev = wdev; /* Get offchain ownership */
++ rdev->background_radar_chandef = *chandef;
++ rdev->background_radar_wdev = wdev; /* Get offchain ownership */
+
+- __cfg80211_offchan_cac_event(rdev, wdev, chandef,
+- NL80211_RADAR_CAC_STARTED);
+- queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_done_wk,
++ __cfg80211_background_cac_event(rdev, wdev, chandef,
++ NL80211_RADAR_CAC_STARTED);
++ queue_delayed_work(cfg80211_wq, &rdev->background_cac_done_wk,
+ msecs_to_jiffies(cac_time_ms));
+
+ return 0;
+ }
+
+-void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev)
++void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev)
+ {
+ struct wiphy *wiphy = wdev->wiphy;
+ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+
+ lockdep_assert_wiphy(wiphy);
+
+- if (wdev != rdev->offchan_radar_wdev)
++ if (wdev != rdev->background_radar_wdev)
+ return;
+
+- rdev_set_radar_offchan(rdev, NULL);
+- rdev->offchan_radar_wdev = NULL; /* Release offchain ownership */
++ rdev_set_radar_background(rdev, NULL);
++ rdev->background_radar_wdev = NULL; /* Release offchain ownership */
+
+- __cfg80211_offchan_cac_event(rdev, wdev, &rdev->offchan_radar_chandef,
+- NL80211_RADAR_CAC_ABORTED);
++ __cfg80211_background_cac_event(rdev, wdev,
++ &rdev->background_radar_chandef,
++ NL80211_RADAR_CAC_ABORTED);
+ }
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -801,7 +801,7 @@ static const struct nla_policy nl80211_p
+ [NL80211_ATTR_MBSSID_CONFIG] =
+ NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
+ [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
+- [NL80211_ATTR_RADAR_OFFCHAN] = { .type = NLA_FLAG },
++ [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
+ };
+
+ /* policy for the key attributes */
+@@ -9306,9 +9306,9 @@ static int nl80211_start_radar_detection
+ goto unlock;
+ }
+
+- if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN])) {
+- err = cfg80211_start_offchan_radar_detection(rdev, wdev,
+- &chandef);
++ if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) {
++ err = cfg80211_start_background_radar_detection(rdev, wdev,
++ &chandef);
+ goto unlock;
+ }
+
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -1382,17 +1382,17 @@ static inline int rdev_color_change(stru
+ }
+
+ static inline int
+-rdev_set_radar_offchan(struct cfg80211_registered_device *rdev,
+- struct cfg80211_chan_def *chandef)
++rdev_set_radar_background(struct cfg80211_registered_device *rdev,
++ struct cfg80211_chan_def *chandef)
+ {
+ struct wiphy *wiphy = &rdev->wiphy;
+ int ret;
+
+- if (!rdev->ops->set_radar_offchan)
++ if (!rdev->ops->set_radar_background)
+ return -EOPNOTSUPP;
+
+- trace_rdev_set_radar_offchan(wiphy, chandef);
+- ret = rdev->ops->set_radar_offchan(wiphy, chandef);
++ trace_rdev_set_radar_background(wiphy, chandef);
++ ret = rdev->ops->set_radar_background(wiphy, chandef);
+ trace_rdev_return_int(wiphy, ret);
+
+ return ret;
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3646,7 +3646,7 @@ TRACE_EVENT(cfg80211_bss_color_notify,
+ __entry->color_bitmap)
+ );
+
+-TRACE_EVENT(rdev_set_radar_offchan,
++TRACE_EVENT(rdev_set_radar_background,
+ TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
+
+ TP_ARGS(wiphy, chandef),
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/323-v5.16-mac80211-MBSSID-support-in-interface-handling.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/323-v5.16-mac80211-MBSSID-support-in-interface-handling.patch
new file mode 100644
index 0000000..a135e3d
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/323-v5.16-mac80211-MBSSID-support-in-interface-handling.patch
@@ -0,0 +1,144 @@
+From: John Crispin <john@phrozen.org>
+Date: Wed, 15 Sep 2021 19:54:35 -0700
+Subject: [PATCH] mac80211: MBSSID support in interface handling
+
+Configure multiple BSSID and enhanced multi-BSSID advertisement (EMA)
+parameters in mac80211 for AP mode.
+
+For each interface, 'mbssid_tx_vif' points to the transmitting interface of
+the MBSSID set. The pointer is set to NULL if MBSSID is disabled.
+
+Function ieee80211_stop() is modified to always bring down all the
+non-transmitting interfaces first and the transmitting interface last.
+
+Signed-off-by: John Crispin <john@phrozen.org>
+Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Link: https://lore.kernel.org/r/20210916025437.29138-3-alokad@codeaurora.org
+[slightly change logic to be more obvious]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1719,6 +1719,7 @@ enum ieee80211_offload_flags {
+ * write-protected by sdata_lock and local->mtx so holding either is fine
+ * for read access.
+ * @color_change_color: the bss color that will be used after the change.
++ * @mbssid_tx_vif: Pointer to the transmitting interface if MBSSID is enabled.
+ */
+ struct ieee80211_vif {
+ enum nl80211_iftype type;
+@@ -1750,6 +1751,8 @@ struct ieee80211_vif {
+ bool color_change_active;
+ u8 color_change_color;
+
++ struct ieee80211_vif *mbssid_tx_vif;
++
+ /* must be last */
+ u8 drv_priv[] __aligned(sizeof(void *));
+ };
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -112,6 +112,36 @@ static int ieee80211_set_mon_options(str
+ return 0;
+ }
+
++static int ieee80211_set_ap_mbssid_options(struct ieee80211_sub_if_data *sdata,
++ struct cfg80211_mbssid_config params)
++{
++ struct ieee80211_sub_if_data *tx_sdata;
++
++ sdata->vif.mbssid_tx_vif = NULL;
++ sdata->vif.bss_conf.bssid_index = 0;
++ sdata->vif.bss_conf.nontransmitted = false;
++ sdata->vif.bss_conf.ema_ap = false;
++
++ if (sdata->vif.type != NL80211_IFTYPE_AP || !params.tx_wdev)
++ return -EINVAL;
++
++ tx_sdata = IEEE80211_WDEV_TO_SUB_IF(params.tx_wdev);
++ if (!tx_sdata)
++ return -EINVAL;
++
++ if (tx_sdata == sdata) {
++ sdata->vif.mbssid_tx_vif = &sdata->vif;
++ } else {
++ sdata->vif.mbssid_tx_vif = &tx_sdata->vif;
++ sdata->vif.bss_conf.nontransmitted = true;
++ sdata->vif.bss_conf.bssid_index = params.index;
++ }
++ if (params.ema)
++ sdata->vif.bss_conf.ema_ap = true;
++
++ return 0;
++}
++
+ static struct wireless_dev *ieee80211_add_iface(struct wiphy *wiphy,
+ const char *name,
+ unsigned char name_assign_type,
+@@ -1107,6 +1137,14 @@ static int ieee80211_start_ap(struct wip
+ changed |= BSS_CHANGED_HE_BSS_COLOR;
+ }
+
++ if (sdata->vif.type == NL80211_IFTYPE_AP &&
++ params->mbssid_config.tx_wdev) {
++ err = ieee80211_set_ap_mbssid_options(sdata,
++ params->mbssid_config);
++ if (err)
++ return err;
++ }
++
+ mutex_lock(&local->mtx);
+ err = ieee80211_vif_use_channel(sdata, ¶ms->chandef,
+ IEEE80211_CHANCTX_SHARED);
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -632,17 +632,46 @@ static void ieee80211_do_stop(struct iee
+ ieee80211_add_virtual_monitor(local);
+ }
+
++static void ieee80211_stop_mbssid(struct ieee80211_sub_if_data *sdata)
++{
++ struct ieee80211_sub_if_data *tx_sdata, *non_tx_sdata, *tmp_sdata;
++ struct ieee80211_vif *tx_vif = sdata->vif.mbssid_tx_vif;
++
++ if (!tx_vif)
++ return;
++
++ tx_sdata = vif_to_sdata(tx_vif);
++ sdata->vif.mbssid_tx_vif = NULL;
++
++ list_for_each_entry_safe(non_tx_sdata, tmp_sdata,
++ &tx_sdata->local->interfaces, list) {
++ if (non_tx_sdata != sdata && non_tx_sdata != tx_sdata &&
++ non_tx_sdata->vif.mbssid_tx_vif == tx_vif &&
++ ieee80211_sdata_running(non_tx_sdata)) {
++ non_tx_sdata->vif.mbssid_tx_vif = NULL;
++ dev_close(non_tx_sdata->wdev.netdev);
++ }
++ }
++
++ if (sdata != tx_sdata && ieee80211_sdata_running(tx_sdata)) {
++ tx_sdata->vif.mbssid_tx_vif = NULL;
++ dev_close(tx_sdata->wdev.netdev);
++ }
++}
++
+ static int ieee80211_stop(struct net_device *dev)
+ {
+ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+- /* close all dependent VLAN interfaces before locking wiphy */
++ /* close dependent VLAN and MBSSID interfaces before locking wiphy */
+ if (sdata->vif.type == NL80211_IFTYPE_AP) {
+ struct ieee80211_sub_if_data *vlan, *tmpsdata;
+
+ list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
+ u.vlan.list)
+ dev_close(vlan->dev);
++
++ ieee80211_stop_mbssid(sdata);
+ }
+
+ wiphy_lock(sdata->local->hw.wiphy);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/324-v5.18-mac80211-MBSSID-beacon-handling-in-AP-mode.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/324-v5.18-mac80211-MBSSID-beacon-handling-in-AP-mode.patch
new file mode 100644
index 0000000..a8fc02f
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/324-v5.18-mac80211-MBSSID-beacon-handling-in-AP-mode.patch
@@ -0,0 +1,326 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Feb 2022 12:54:58 +0100
+Subject: [PATCH] mac80211: MBSSID beacon handling in AP mode
+
+Add new fields in struct beacon_data to store all MBSSID elements.
+Generate a beacon template which includes all MBSSID elements.
+Move CSA offset to reflect the MBSSID element length.
+
+Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Co-developed-by: John Crispin <john@phrozen.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Tested-by: Money Wang <money.wang@mediatek.com>
+Link: https://lore.kernel.org/r/5322db3c303f431adaf191ab31c45e151dde5465.1645702516.git.lorenzo@kernel.org
+[small cleanups]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -4938,12 +4938,14 @@ void ieee80211_report_low_ack(struct iee
+ * @cntdwn_counter_offs: array of IEEE80211_MAX_CNTDWN_COUNTERS_NUM offsets
+ * to countdown counters. This array can contain zero values which
+ * should be ignored.
++ * @mbssid_off: position of the multiple bssid element
+ */
+ struct ieee80211_mutable_offsets {
+ u16 tim_offset;
+ u16 tim_length;
+
+ u16 cntdwn_counter_offs[IEEE80211_MAX_CNTDWN_COUNTERS_NUM];
++ u16 mbssid_off;
+ };
+
+ /**
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -989,11 +989,29 @@ static int ieee80211_set_ftm_responder_p
+ return 0;
+ }
+
++static int
++ieee80211_copy_mbssid_beacon(u8 *pos, struct cfg80211_mbssid_elems *dst,
++ struct cfg80211_mbssid_elems *src)
++{
++ int i, offset = 0;
++
++ for (i = 0; i < src->cnt; i++) {
++ memcpy(pos + offset, src->elem[i].data, src->elem[i].len);
++ dst->elem[i].len = src->elem[i].len;
++ dst->elem[i].data = pos + offset;
++ offset += dst->elem[i].len;
++ }
++ dst->cnt = src->cnt;
++
++ return offset;
++}
++
+ static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
+ struct cfg80211_beacon_data *params,
+ const struct ieee80211_csa_settings *csa,
+ const struct ieee80211_color_change_settings *cca)
+ {
++ struct cfg80211_mbssid_elems *mbssid = NULL;
+ struct beacon_data *new, *old;
+ int new_head_len, new_tail_len;
+ int size, err;
+@@ -1021,6 +1039,17 @@ static int ieee80211_assign_beacon(struc
+
+ size = sizeof(*new) + new_head_len + new_tail_len;
+
++ /* new or old multiple BSSID elements? */
++ if (params->mbssid_ies) {
++ mbssid = params->mbssid_ies;
++ size += struct_size(new->mbssid_ies, elem, mbssid->cnt);
++ size += ieee80211_get_mbssid_beacon_len(mbssid);
++ } else if (old && old->mbssid_ies) {
++ mbssid = old->mbssid_ies;
++ size += struct_size(new->mbssid_ies, elem, mbssid->cnt);
++ size += ieee80211_get_mbssid_beacon_len(mbssid);
++ }
++
+ new = kzalloc(size, GFP_KERNEL);
+ if (!new)
+ return -ENOMEM;
+@@ -1029,12 +1058,20 @@ static int ieee80211_assign_beacon(struc
+
+ /*
+ * pointers go into the block we allocated,
+- * memory is | beacon_data | head | tail |
++ * memory is | beacon_data | head | tail | mbssid_ies
+ */
+ new->head = ((u8 *) new) + sizeof(*new);
+ new->tail = new->head + new_head_len;
+ new->head_len = new_head_len;
+ new->tail_len = new_tail_len;
++ /* copy in optional mbssid_ies */
++ if (mbssid) {
++ u8 *pos = new->tail + new->tail_len;
++
++ new->mbssid_ies = (void *)pos;
++ pos += struct_size(new->mbssid_ies, elem, mbssid->cnt);
++ ieee80211_copy_mbssid_beacon(pos, new->mbssid_ies, mbssid);
++ }
+
+ if (csa) {
+ new->cntdwn_current_counter = csa->count;
+@@ -1332,8 +1369,11 @@ static int ieee80211_stop_ap(struct wiph
+
+ mutex_unlock(&local->mtx);
+
+- kfree(sdata->u.ap.next_beacon);
+- sdata->u.ap.next_beacon = NULL;
++ if (sdata->u.ap.next_beacon) {
++ kfree(sdata->u.ap.next_beacon->mbssid_ies);
++ kfree(sdata->u.ap.next_beacon);
++ sdata->u.ap.next_beacon = NULL;
++ }
+
+ /* turn off carrier for this interface and dependent VLANs */
+ list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+@@ -3126,12 +3166,24 @@ cfg80211_beacon_dup(struct cfg80211_beac
+
+ len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +
+ beacon->proberesp_ies_len + beacon->assocresp_ies_len +
+- beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len;
++ beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len +
++ ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
+
+ new_beacon = kzalloc(sizeof(*new_beacon) + len, GFP_KERNEL);
+ if (!new_beacon)
+ return NULL;
+
++ if (beacon->mbssid_ies && beacon->mbssid_ies->cnt) {
++ new_beacon->mbssid_ies =
++ kzalloc(struct_size(new_beacon->mbssid_ies,
++ elem, beacon->mbssid_ies->cnt),
++ GFP_KERNEL);
++ if (!new_beacon->mbssid_ies) {
++ kfree(new_beacon);
++ return NULL;
++ }
++ }
++
+ pos = (u8 *)(new_beacon + 1);
+ if (beacon->head_len) {
+ new_beacon->head_len = beacon->head_len;
+@@ -3169,6 +3221,10 @@ cfg80211_beacon_dup(struct cfg80211_beac
+ memcpy(pos, beacon->probe_resp, beacon->probe_resp_len);
+ pos += beacon->probe_resp_len;
+ }
++ if (beacon->mbssid_ies && beacon->mbssid_ies->cnt)
++ pos += ieee80211_copy_mbssid_beacon(pos,
++ new_beacon->mbssid_ies,
++ beacon->mbssid_ies);
+
+ /* might copy -1, meaning no changes requested */
+ new_beacon->ftm_responder = beacon->ftm_responder;
+@@ -3206,8 +3262,11 @@ static int ieee80211_set_after_csa_beaco
+ case NL80211_IFTYPE_AP:
+ err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
+ NULL, NULL);
+- kfree(sdata->u.ap.next_beacon);
+- sdata->u.ap.next_beacon = NULL;
++ if (sdata->u.ap.next_beacon) {
++ kfree(sdata->u.ap.next_beacon->mbssid_ies);
++ kfree(sdata->u.ap.next_beacon);
++ sdata->u.ap.next_beacon = NULL;
++ }
+
+ if (err < 0)
+ return err;
+@@ -3362,8 +3421,12 @@ static int ieee80211_set_csa_beacon(stru
+ if ((params->n_counter_offsets_beacon >
+ IEEE80211_MAX_CNTDWN_COUNTERS_NUM) ||
+ (params->n_counter_offsets_presp >
+- IEEE80211_MAX_CNTDWN_COUNTERS_NUM))
++ IEEE80211_MAX_CNTDWN_COUNTERS_NUM)) {
++ kfree(sdata->u.ap.next_beacon->mbssid_ies);
++ kfree(sdata->u.ap.next_beacon);
++ sdata->u.ap.next_beacon = NULL;
+ return -EINVAL;
++ }
+
+ csa.counter_offsets_beacon = params->counter_offsets_beacon;
+ csa.counter_offsets_presp = params->counter_offsets_presp;
+@@ -3373,7 +3436,9 @@ static int ieee80211_set_csa_beacon(stru
+
+ err = ieee80211_assign_beacon(sdata, ¶ms->beacon_csa, &csa, NULL);
+ if (err < 0) {
++ kfree(sdata->u.ap.next_beacon->mbssid_ies);
+ kfree(sdata->u.ap.next_beacon);
++ sdata->u.ap.next_beacon = NULL;
+ return err;
+ }
+ *changed |= err;
+@@ -3460,8 +3525,11 @@ static int ieee80211_set_csa_beacon(stru
+ static void ieee80211_color_change_abort(struct ieee80211_sub_if_data *sdata)
+ {
+ sdata->vif.color_change_active = false;
+- kfree(sdata->u.ap.next_beacon);
+- sdata->u.ap.next_beacon = NULL;
++ if (sdata->u.ap.next_beacon) {
++ kfree(sdata->u.ap.next_beacon->mbssid_ies);
++ kfree(sdata->u.ap.next_beacon);
++ sdata->u.ap.next_beacon = NULL;
++ }
+
+ cfg80211_color_change_aborted_notify(sdata->dev);
+ }
+@@ -4199,8 +4267,11 @@ ieee80211_set_after_color_change_beacon(
+
+ ret = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
+ NULL, NULL);
+- kfree(sdata->u.ap.next_beacon);
+- sdata->u.ap.next_beacon = NULL;
++ if (sdata->u.ap.next_beacon) {
++ kfree(sdata->u.ap.next_beacon->mbssid_ies);
++ kfree(sdata->u.ap.next_beacon);
++ sdata->u.ap.next_beacon = NULL;
++ }
+
+ if (ret < 0)
+ return ret;
+@@ -4243,7 +4314,11 @@ ieee80211_set_color_change_beacon(struct
+ err = ieee80211_assign_beacon(sdata, ¶ms->beacon_color_change,
+ NULL, &color_change);
+ if (err < 0) {
+- kfree(sdata->u.ap.next_beacon);
++ if (sdata->u.ap.next_beacon) {
++ kfree(sdata->u.ap.next_beacon->mbssid_ies);
++ kfree(sdata->u.ap.next_beacon);
++ sdata->u.ap.next_beacon = NULL;
++ }
+ return err;
+ }
+ *changed |= err;
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -261,6 +261,7 @@ struct beacon_data {
+ struct ieee80211_meshconf_ie *meshconf;
+ u16 cntdwn_counter_offsets[IEEE80211_MAX_CNTDWN_COUNTERS_NUM];
+ u8 cntdwn_current_counter;
++ struct cfg80211_mbssid_elems *mbssid_ies;
+ struct rcu_head rcu_head;
+ };
+
+@@ -1082,6 +1083,20 @@ ieee80211_vif_get_shift(struct ieee80211
+ return shift;
+ }
+
++static inline int
++ieee80211_get_mbssid_beacon_len(struct cfg80211_mbssid_elems *elems)
++{
++ int i, len = 0;
++
++ if (!elems)
++ return 0;
++
++ for (i = 0; i < elems->cnt; i++)
++ len += elems->elem[i].len;
++
++ return len;
++}
++
+ enum {
+ IEEE80211_RX_MSG = 1,
+ IEEE80211_TX_STATUS_MSG = 2,
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -5041,6 +5041,19 @@ ieee80211_beacon_get_finish(struct ieee8
+ IEEE80211_TX_CTL_FIRST_FRAGMENT;
+ }
+
++static void
++ieee80211_beacon_add_mbssid(struct sk_buff *skb, struct beacon_data *beacon)
++{
++ int i;
++
++ if (!beacon->mbssid_ies)
++ return;
++
++ for (i = 0; i < beacon->mbssid_ies->cnt; i++)
++ skb_put_data(skb, beacon->mbssid_ies->elem[i].data,
++ beacon->mbssid_ies->elem[i].len);
++}
++
+ static struct sk_buff *
+ ieee80211_beacon_get_ap(struct ieee80211_hw *hw,
+ struct ieee80211_vif *vif,
+@@ -5054,6 +5067,7 @@ ieee80211_beacon_get_ap(struct ieee80211
+ struct ieee80211_if_ap *ap = &sdata->u.ap;
+ struct sk_buff *skb = NULL;
+ u16 csa_off_base = 0;
++ int mbssid_len;
+
+ if (beacon->cntdwn_counter_offsets[0]) {
+ if (!is_template)
+@@ -5063,11 +5077,12 @@ ieee80211_beacon_get_ap(struct ieee80211
+ }
+
+ /* headroom, head length,
+- * tail length and maximum TIM length
++ * tail length, maximum TIM length and multiple BSSID length
+ */
++ mbssid_len = ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
+ skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
+ beacon->tail_len + 256 +
+- local->hw.extra_beacon_tailroom);
++ local->hw.extra_beacon_tailroom + mbssid_len);
+ if (!skb)
+ return NULL;
+
+@@ -5081,6 +5096,11 @@ ieee80211_beacon_get_ap(struct ieee80211
+ offs->tim_length = skb->len - beacon->head_len;
+ offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
+
++ if (mbssid_len) {
++ ieee80211_beacon_add_mbssid(skb, beacon);
++ offs->mbssid_off = skb->len - mbssid_len;
++ }
++
+ /* for AP the csa offsets are from tail */
+ csa_off_base = skb->len;
+ }
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/325-v5.18-mac80211-MBSSID-channel-switch.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/325-v5.18-mac80211-MBSSID-channel-switch.patch
new file mode 100644
index 0000000..38b0de1
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/325-v5.18-mac80211-MBSSID-channel-switch.patch
@@ -0,0 +1,52 @@
+From: John Crispin <john@phrozen.org>
+Date: Thu, 24 Feb 2022 12:54:59 +0100
+Subject: [PATCH] mac80211: MBSSID channel switch
+
+Trigger ieee80211_csa_finish() on the non-transmitting interfaces
+when channel switch concludes on the transmitting interface.
+
+Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
+Signed-off-by: John Crispin <john@phrozen.org>
+Link: https://lore.kernel.org/r/6fde4d7f9fa387494f46a7aa4a584478dcda06f1.1645702516.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -3247,9 +3247,31 @@ cfg80211_beacon_dup(struct cfg80211_beac
+ void ieee80211_csa_finish(struct ieee80211_vif *vif)
+ {
+ struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
++ struct ieee80211_local *local = sdata->local;
+
+- ieee80211_queue_work(&sdata->local->hw,
+- &sdata->csa_finalize_work);
++ rcu_read_lock();
++
++ if (vif->mbssid_tx_vif == vif) {
++ /* Trigger ieee80211_csa_finish() on the non-transmitting
++ * interfaces when channel switch is received on
++ * transmitting interface
++ */
++ struct ieee80211_sub_if_data *iter;
++
++ list_for_each_entry_rcu(iter, &local->interfaces, list) {
++ if (!ieee80211_sdata_running(iter))
++ continue;
++
++ if (iter == sdata || iter->vif.mbssid_tx_vif != vif)
++ continue;
++
++ ieee80211_queue_work(&iter->local->hw,
++ &iter->csa_finalize_work);
++ }
++ }
++ ieee80211_queue_work(&local->hw, &sdata->csa_finalize_work);
++
++ rcu_read_unlock();
+ }
+ EXPORT_SYMBOL(ieee80211_csa_finish);
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/326-v5.18-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/326-v5.18-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch
new file mode 100644
index 0000000..1955568
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/326-v5.18-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch
@@ -0,0 +1,25 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 24 Feb 2022 12:55:00 +0100
+Subject: [PATCH] mac80211: update bssid_indicator in
+ ieee80211_assign_beacon
+
+Update bssid_indicator in ieee80211_bss_conf according to the
+number of bssid in the set.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/f92317e002fca9933f05a445fcefb4f53291d601.1645702516.git.lorenzo@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1071,6 +1071,9 @@ static int ieee80211_assign_beacon(struc
+ new->mbssid_ies = (void *)pos;
+ pos += struct_size(new->mbssid_ies, elem, mbssid->cnt);
+ ieee80211_copy_mbssid_beacon(pos, new->mbssid_ies, mbssid);
++ /* update bssid_indicator */
++ sdata->vif.bss_conf.bssid_indicator =
++ ilog2(__roundup_pow_of_two(mbssid->cnt + 1));
+ }
+
+ if (csa) {
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/328-v5.19-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/328-v5.19-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch
new file mode 100644
index 0000000..f0150dd
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/328-v5.19-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch
@@ -0,0 +1,38 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 26 Mar 2022 23:58:35 +0100
+Subject: [PATCH] mac80211: do not wake queues on a vif that is being stopped
+
+When a vif is being removed and sdata->bss is cleared, __ieee80211_wake_txqs
+can still be called on it, which crashes as soon as sdata->bss is being
+dereferenced.
+To fix this properly, check for SDATA_STATE_RUNNING before waking queues,
+and take the fq lock when setting it (to ensure that __ieee80211_wake_txqs
+observes the change when running on a different CPU
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -377,7 +377,9 @@ static void ieee80211_do_stop(struct iee
+ bool cancel_scan;
+ struct cfg80211_nan_func *func;
+
++ spin_lock_bh(&local->fq.lock);
+ clear_bit(SDATA_STATE_RUNNING, &sdata->state);
++ spin_unlock_bh(&local->fq.lock);
+
+ cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
+ if (cancel_scan)
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -301,6 +301,9 @@ static void __ieee80211_wake_txqs(struct
+ local_bh_disable();
+ spin_lock(&fq->lock);
+
++ if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
++ goto out;
++
+ if (sdata->vif.type == NL80211_IFTYPE_AP)
+ ps = &sdata->bss->ps;
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/330-v6.0-mac80211-switch-airtime-fairness-back-to-deficit-rou.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/330-v6.0-mac80211-switch-airtime-fairness-back-to-deficit-rou.patch
new file mode 100644
index 0000000..e59036f
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/330-v6.0-mac80211-switch-airtime-fairness-back-to-deficit-rou.patch
@@ -0,0 +1,1249 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 19 Jun 2022 23:13:05 +0200
+Subject: [PATCH] mac80211: switch airtime fairness back to deficit round-robin
+ scheduling
+
+This reverts commits 6a789ba679d652587532cec2a0e0274fda172f3b and
+2433647bc8d983a543e7d31b41ca2de1c7e2c198.
+
+The virtual time scheduler code has a number of issues:
+- queues slowed down by hardware/firmware powersave handling were not properly
+ handled.
+- on ath10k in push-pull mode, tx queues that the driver tries to pull from
+ were starved, causing excessive latency
+- delay between tx enqueue and reported airtime use were causing excessively
+ bursty tx behavior
+
+The bursty behavior may also be present on the round-robin scheduler, but there
+it is much easier to fix without introducing additional regressions
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -6666,6 +6666,9 @@ static inline void ieee80211_txq_schedul
+ {
+ }
+
++void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
++ struct ieee80211_txq *txq, bool force);
++
+ /**
+ * ieee80211_schedule_txq - schedule a TXQ for transmission
+ *
+@@ -6678,7 +6681,11 @@ static inline void ieee80211_txq_schedul
+ * The driver may call this function if it has buffered packets for
+ * this TXQ internally.
+ */
+-void ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq);
++static inline void
++ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
++{
++ __ieee80211_schedule_txq(hw, txq, true);
++}
+
+ /**
+ * ieee80211_return_txq - return a TXQ previously acquired by ieee80211_next_txq()
+@@ -6690,8 +6697,12 @@ void ieee80211_schedule_txq(struct ieee8
+ * The driver may set force=true if it has buffered packets for this TXQ
+ * internally.
+ */
+-void ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq,
+- bool force);
++static inline void
++ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq,
++ bool force)
++{
++ __ieee80211_schedule_txq(hw, txq, force);
++}
+
+ /**
+ * ieee80211_txq_may_transmit - check whether TXQ is allowed to transmit
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1554,38 +1554,6 @@ static void sta_apply_mesh_params(struct
+ #endif
+ }
+
+-static void sta_apply_airtime_params(struct ieee80211_local *local,
+- struct sta_info *sta,
+- struct station_parameters *params)
+-{
+- u8 ac;
+-
+- for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+- struct airtime_sched_info *air_sched = &local->airtime[ac];
+- struct airtime_info *air_info = &sta->airtime[ac];
+- struct txq_info *txqi;
+- u8 tid;
+-
+- spin_lock_bh(&air_sched->lock);
+- for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
+- if (air_info->weight == params->airtime_weight ||
+- !sta->sta.txq[tid] ||
+- ac != ieee80211_ac_from_tid(tid))
+- continue;
+-
+- airtime_weight_set(air_info, params->airtime_weight);
+-
+- txqi = to_txq_info(sta->sta.txq[tid]);
+- if (RB_EMPTY_NODE(&txqi->schedule_order))
+- continue;
+-
+- ieee80211_update_airtime_weight(local, air_sched,
+- 0, true);
+- }
+- spin_unlock_bh(&air_sched->lock);
+- }
+-}
+-
+ static int sta_apply_parameters(struct ieee80211_local *local,
+ struct sta_info *sta,
+ struct station_parameters *params)
+@@ -1773,8 +1741,7 @@ static int sta_apply_parameters(struct i
+ sta_apply_mesh_params(local, sta, params);
+
+ if (params->airtime_weight)
+- sta_apply_airtime_params(local, sta, params);
+-
++ sta->airtime_weight = params->airtime_weight;
+
+ /* set the STA state after all sta info from usermode has been set */
+ if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) ||
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -216,14 +216,14 @@ static ssize_t aql_txq_limit_read(struct
+ "VI %u %u\n"
+ "BE %u %u\n"
+ "BK %u %u\n",
+- local->airtime[IEEE80211_AC_VO].aql_txq_limit_low,
+- local->airtime[IEEE80211_AC_VO].aql_txq_limit_high,
+- local->airtime[IEEE80211_AC_VI].aql_txq_limit_low,
+- local->airtime[IEEE80211_AC_VI].aql_txq_limit_high,
+- local->airtime[IEEE80211_AC_BE].aql_txq_limit_low,
+- local->airtime[IEEE80211_AC_BE].aql_txq_limit_high,
+- local->airtime[IEEE80211_AC_BK].aql_txq_limit_low,
+- local->airtime[IEEE80211_AC_BK].aql_txq_limit_high);
++ local->aql_txq_limit_low[IEEE80211_AC_VO],
++ local->aql_txq_limit_high[IEEE80211_AC_VO],
++ local->aql_txq_limit_low[IEEE80211_AC_VI],
++ local->aql_txq_limit_high[IEEE80211_AC_VI],
++ local->aql_txq_limit_low[IEEE80211_AC_BE],
++ local->aql_txq_limit_high[IEEE80211_AC_BE],
++ local->aql_txq_limit_low[IEEE80211_AC_BK],
++ local->aql_txq_limit_high[IEEE80211_AC_BK]);
+ return simple_read_from_buffer(user_buf, count, ppos,
+ buf, len);
+ }
+@@ -255,11 +255,11 @@ static ssize_t aql_txq_limit_write(struc
+ if (ac >= IEEE80211_NUM_ACS)
+ return -EINVAL;
+
+- q_limit_low_old = local->airtime[ac].aql_txq_limit_low;
+- q_limit_high_old = local->airtime[ac].aql_txq_limit_high;
++ q_limit_low_old = local->aql_txq_limit_low[ac];
++ q_limit_high_old = local->aql_txq_limit_high[ac];
+
+- local->airtime[ac].aql_txq_limit_low = q_limit_low;
+- local->airtime[ac].aql_txq_limit_high = q_limit_high;
++ local->aql_txq_limit_low[ac] = q_limit_low;
++ local->aql_txq_limit_high[ac] = q_limit_high;
+
+ mutex_lock(&local->sta_mtx);
+ list_for_each_entry(sta, &local->sta_list, list) {
+@@ -382,46 +382,6 @@ static const struct file_operations forc
+ .llseek = default_llseek,
+ };
+
+-static ssize_t airtime_read(struct file *file,
+- char __user *user_buf,
+- size_t count,
+- loff_t *ppos)
+-{
+- struct ieee80211_local *local = file->private_data;
+- char buf[200];
+- u64 v_t[IEEE80211_NUM_ACS];
+- u64 wt[IEEE80211_NUM_ACS];
+- int len = 0, ac;
+-
+- for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+- spin_lock_bh(&local->airtime[ac].lock);
+- v_t[ac] = local->airtime[ac].v_t;
+- wt[ac] = local->airtime[ac].weight_sum;
+- spin_unlock_bh(&local->airtime[ac].lock);
+- }
+- len = scnprintf(buf, sizeof(buf),
+- "\tVO VI BE BK\n"
+- "Virt-t\t%-10llu %-10llu %-10llu %-10llu\n"
+- "Weight\t%-10llu %-10llu %-10llu %-10llu\n",
+- v_t[0],
+- v_t[1],
+- v_t[2],
+- v_t[3],
+- wt[0],
+- wt[1],
+- wt[2],
+- wt[3]);
+-
+- return simple_read_from_buffer(user_buf, count, ppos,
+- buf, len);
+-}
+-
+-static const struct file_operations airtime_ops = {
+- .read = airtime_read,
+- .open = simple_open,
+- .llseek = default_llseek,
+-};
+-
+ #ifdef CONFIG_PM
+ static ssize_t reset_write(struct file *file, const char __user *user_buf,
+ size_t count, loff_t *ppos)
+@@ -672,11 +632,7 @@ void debugfs_hw_add(struct ieee80211_loc
+ if (local->ops->wake_tx_queue)
+ DEBUGFS_ADD_MODE(aqm, 0600);
+
+- if (wiphy_ext_feature_isset(local->hw.wiphy,
+- NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) {
+- DEBUGFS_ADD_MODE(airtime, 0600);
+- DEBUGFS_ADD_MODE(airtime_flags, 0600);
+- }
++ DEBUGFS_ADD_MODE(airtime_flags, 0600);
+
+ DEBUGFS_ADD(aql_txq_limit);
+ debugfs_create_u32("aql_threshold", 0600,
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -512,34 +512,6 @@ static ssize_t ieee80211_if_fmt_aqm(
+ }
+ IEEE80211_IF_FILE_R(aqm);
+
+-static ssize_t ieee80211_if_fmt_airtime(
+- const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
+-{
+- struct ieee80211_local *local = sdata->local;
+- struct ieee80211_txq *txq = sdata->vif.txq;
+- struct airtime_info *air_info;
+- int len;
+-
+- if (!txq)
+- return 0;
+-
+- spin_lock_bh(&local->airtime[txq->ac].lock);
+- air_info = to_airtime_info(txq);
+- len = scnprintf(buf,
+- buflen,
+- "RX: %llu us\nTX: %llu us\nWeight: %u\n"
+- "Virt-T: %lld us\n",
+- air_info->rx_airtime,
+- air_info->tx_airtime,
+- air_info->weight,
+- air_info->v_t);
+- spin_unlock_bh(&local->airtime[txq->ac].lock);
+-
+- return len;
+-}
+-
+-IEEE80211_IF_FILE_R(airtime);
+-
+ IEEE80211_IF_FILE(multicast_to_unicast, u.ap.multicast_to_unicast, HEX);
+
+ /* IBSS attributes */
+@@ -685,10 +657,8 @@ static void add_common_files(struct ieee
+
+ if (sdata->local->ops->wake_tx_queue &&
+ sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
+- sdata->vif.type != NL80211_IFTYPE_NAN) {
++ sdata->vif.type != NL80211_IFTYPE_NAN)
+ DEBUGFS_ADD(aqm);
+- DEBUGFS_ADD(airtime);
+- }
+ }
+
+ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -202,7 +202,7 @@ static ssize_t sta_airtime_read(struct f
+ size_t bufsz = 400;
+ char *buf = kzalloc(bufsz, GFP_KERNEL), *p = buf;
+ u64 rx_airtime = 0, tx_airtime = 0;
+- u64 v_t[IEEE80211_NUM_ACS];
++ s64 deficit[IEEE80211_NUM_ACS];
+ ssize_t rv;
+ int ac;
+
+@@ -210,18 +210,18 @@ static ssize_t sta_airtime_read(struct f
+ return -ENOMEM;
+
+ for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+- spin_lock_bh(&local->airtime[ac].lock);
++ spin_lock_bh(&local->active_txq_lock[ac]);
+ rx_airtime += sta->airtime[ac].rx_airtime;
+ tx_airtime += sta->airtime[ac].tx_airtime;
+- v_t[ac] = sta->airtime[ac].v_t;
+- spin_unlock_bh(&local->airtime[ac].lock);
++ deficit[ac] = sta->airtime[ac].deficit;
++ spin_unlock_bh(&local->active_txq_lock[ac]);
+ }
+
+ p += scnprintf(p, bufsz + buf - p,
+ "RX: %llu us\nTX: %llu us\nWeight: %u\n"
+- "Virt-T: VO: %lld us VI: %lld us BE: %lld us BK: %lld us\n",
+- rx_airtime, tx_airtime, sta->airtime[0].weight,
+- v_t[0], v_t[1], v_t[2], v_t[3]);
++ "Deficit: VO: %lld us VI: %lld us BE: %lld us BK: %lld us\n",
++ rx_airtime, tx_airtime, sta->airtime_weight,
++ deficit[0], deficit[1], deficit[2], deficit[3]);
+
+ rv = simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
+ kfree(buf);
+@@ -236,11 +236,11 @@ static ssize_t sta_airtime_write(struct
+ int ac;
+
+ for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+- spin_lock_bh(&local->airtime[ac].lock);
++ spin_lock_bh(&local->active_txq_lock[ac]);
+ sta->airtime[ac].rx_airtime = 0;
+ sta->airtime[ac].tx_airtime = 0;
+- sta->airtime[ac].v_t = 0;
+- spin_unlock_bh(&local->airtime[ac].lock);
++ sta->airtime[ac].deficit = sta->airtime_weight;
++ spin_unlock_bh(&local->active_txq_lock[ac]);
+ }
+
+ return count;
+@@ -263,10 +263,10 @@ static ssize_t sta_aql_read(struct file
+ return -ENOMEM;
+
+ for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+- spin_lock_bh(&local->airtime[ac].lock);
++ spin_lock_bh(&local->active_txq_lock[ac]);
+ q_limit_l[ac] = sta->airtime[ac].aql_limit_low;
+ q_limit_h[ac] = sta->airtime[ac].aql_limit_high;
+- spin_unlock_bh(&local->airtime[ac].lock);
++ spin_unlock_bh(&local->active_txq_lock[ac]);
+ q_depth[ac] = atomic_read(&sta->airtime[ac].aql_tx_pending);
+ }
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -862,16 +862,20 @@ enum txq_info_flags {
+ * @def_flow: used as a fallback flow when a packet destined to @tin hashes to
+ * a fq_flow which is already owned by a different tin
+ * @def_cvars: codel vars for @def_flow
+- * @schedule_order: used with ieee80211_local->active_txqs
+ * @frags: used to keep fragments created after dequeue
++ * @schedule_order: used with ieee80211_local->active_txqs
++ * @schedule_round: counter to prevent infinite loops on TXQ scheduling
+ */
+ struct txq_info {
+ struct fq_tin tin;
+ struct codel_vars def_cvars;
+ struct codel_stats cstats;
+- struct rb_node schedule_order;
++
++ u16 schedule_round;
++ struct list_head schedule_order;
+
+ struct sk_buff_head frags;
++
+ unsigned long flags;
+
+ /* keep last! */
+@@ -948,8 +952,6 @@ struct ieee80211_sub_if_data {
+ struct ieee80211_tx_queue_params tx_conf[IEEE80211_NUM_ACS];
+ struct mac80211_qos_map __rcu *qos_map;
+
+- struct airtime_info airtime[IEEE80211_NUM_ACS];
+-
+ struct work_struct csa_finalize_work;
+ bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */
+ struct cfg80211_chan_def csa_chandef;
+@@ -1184,44 +1186,6 @@ enum mac80211_scan_state {
+ SCAN_ABORT,
+ };
+
+-/**
+- * struct airtime_sched_info - state used for airtime scheduling and AQL
+- *
+- * @lock: spinlock that protects all the fields in this struct
+- * @active_txqs: rbtree of currently backlogged queues, sorted by virtual time
+- * @schedule_pos: the current position maintained while a driver walks the tree
+- * with ieee80211_next_txq()
+- * @active_list: list of struct airtime_info structs that were active within
+- * the last AIRTIME_ACTIVE_DURATION (100 ms), used to compute
+- * weight_sum
+- * @last_weight_update: used for rate limiting walking active_list
+- * @last_schedule_time: tracks the last time a transmission was scheduled; used
+- * for catching up v_t if no stations are eligible for
+- * transmission.
+- * @v_t: global virtual time; queues with v_t < this are eligible for
+- * transmission
+- * @weight_sum: total sum of all active stations used for dividing airtime
+- * @weight_sum_reciprocal: reciprocal of weight_sum (to avoid divisions in fast
+- * path - see comment above
+- * IEEE80211_RECIPROCAL_DIVISOR_64)
+- * @aql_txq_limit_low: AQL limit when total outstanding airtime
+- * is < IEEE80211_AQL_THRESHOLD
+- * @aql_txq_limit_high: AQL limit when total outstanding airtime
+- * is > IEEE80211_AQL_THRESHOLD
+- */
+-struct airtime_sched_info {
+- spinlock_t lock;
+- struct rb_root_cached active_txqs;
+- struct rb_node *schedule_pos;
+- struct list_head active_list;
+- u64 last_weight_update;
+- u64 last_schedule_activity;
+- u64 v_t;
+- u64 weight_sum;
+- u64 weight_sum_reciprocal;
+- u32 aql_txq_limit_low;
+- u32 aql_txq_limit_high;
+-};
+ DECLARE_STATIC_KEY_FALSE(aql_disable);
+
+ struct ieee80211_local {
+@@ -1235,8 +1199,13 @@ struct ieee80211_local {
+ struct codel_params cparams;
+
+ /* protects active_txqs and txqi->schedule_order */
+- struct airtime_sched_info airtime[IEEE80211_NUM_ACS];
++ spinlock_t active_txq_lock[IEEE80211_NUM_ACS];
++ struct list_head active_txqs[IEEE80211_NUM_ACS];
++ u16 schedule_round[IEEE80211_NUM_ACS];
++
+ u16 airtime_flags;
++ u32 aql_txq_limit_low[IEEE80211_NUM_ACS];
++ u32 aql_txq_limit_high[IEEE80211_NUM_ACS];
+ u32 aql_threshold;
+ atomic_t aql_total_pending_airtime;
+
+@@ -1660,125 +1629,6 @@ static inline bool txq_has_queue(struct
+ return !(skb_queue_empty(&txqi->frags) && !txqi->tin.backlog_packets);
+ }
+
+-static inline struct airtime_info *to_airtime_info(struct ieee80211_txq *txq)
+-{
+- struct ieee80211_sub_if_data *sdata;
+- struct sta_info *sta;
+-
+- if (txq->sta) {
+- sta = container_of(txq->sta, struct sta_info, sta);
+- return &sta->airtime[txq->ac];
+- }
+-
+- sdata = vif_to_sdata(txq->vif);
+- return &sdata->airtime[txq->ac];
+-}
+-
+-/* To avoid divisions in the fast path, we keep pre-computed reciprocals for
+- * airtime weight calculations. There are two different weights to keep track
+- * of: The per-station weight and the sum of weights per phy.
+- *
+- * For the per-station weights (kept in airtime_info below), we use 32-bit
+- * reciprocals with a devisor of 2^19. This lets us keep the multiplications and
+- * divisions for the station weights as 32-bit operations at the cost of a bit
+- * of rounding error for high weights; but the choice of divisor keeps rounding
+- * errors <10% for weights <2^15, assuming no more than 8ms of airtime is
+- * reported at a time.
+- *
+- * For the per-phy sum of weights the values can get higher, so we use 64-bit
+- * operations for those with a 32-bit divisor, which should avoid any
+- * significant rounding errors.
+- */
+-#define IEEE80211_RECIPROCAL_DIVISOR_64 0x100000000ULL
+-#define IEEE80211_RECIPROCAL_SHIFT_64 32
+-#define IEEE80211_RECIPROCAL_DIVISOR_32 0x80000U
+-#define IEEE80211_RECIPROCAL_SHIFT_32 19
+-
+-static inline void airtime_weight_set(struct airtime_info *air_info, u16 weight)
+-{
+- if (air_info->weight == weight)
+- return;
+-
+- air_info->weight = weight;
+- if (weight) {
+- air_info->weight_reciprocal =
+- IEEE80211_RECIPROCAL_DIVISOR_32 / weight;
+- } else {
+- air_info->weight_reciprocal = 0;
+- }
+-}
+-
+-static inline void airtime_weight_sum_set(struct airtime_sched_info *air_sched,
+- int weight_sum)
+-{
+- if (air_sched->weight_sum == weight_sum)
+- return;
+-
+- air_sched->weight_sum = weight_sum;
+- if (air_sched->weight_sum) {
+- air_sched->weight_sum_reciprocal = IEEE80211_RECIPROCAL_DIVISOR_64;
+- do_div(air_sched->weight_sum_reciprocal, air_sched->weight_sum);
+- } else {
+- air_sched->weight_sum_reciprocal = 0;
+- }
+-}
+-
+-/* A problem when trying to enforce airtime fairness is that we want to divide
+- * the airtime between the currently *active* stations. However, basing this on
+- * the instantaneous queue state of stations doesn't work, as queues tend to
+- * oscillate very quickly between empty and occupied, leading to the scheduler
+- * thinking only a single station is active when deciding whether to allow
+- * transmission (and thus not throttling correctly).
+- *
+- * To fix this we use a timer-based notion of activity: a station is considered
+- * active if it has been scheduled within the last 100 ms; we keep a separate
+- * list of all the stations considered active in this manner, and lazily update
+- * the total weight of active stations from this list (filtering the stations in
+- * the list by their 'last active' time).
+- *
+- * We add one additional safeguard to guard against stations that manage to get
+- * scheduled every 100 ms but don't transmit a lot of data, and thus don't use
+- * up any airtime. Such stations would be able to get priority for an extended
+- * period of time if they do start transmitting at full capacity again, and so
+- * we add an explicit maximum for how far behind a station is allowed to fall in
+- * the virtual airtime domain. This limit is set to a relatively high value of
+- * 20 ms because the main mechanism for catching up idle stations is the active
+- * state as described above; i.e., the hard limit should only be hit in
+- * pathological cases.
+- */
+-#define AIRTIME_ACTIVE_DURATION (100 * NSEC_PER_MSEC)
+-#define AIRTIME_MAX_BEHIND 20000 /* 20 ms */
+-
+-static inline bool airtime_is_active(struct airtime_info *air_info, u64 now)
+-{
+- return air_info->last_scheduled >= now - AIRTIME_ACTIVE_DURATION;
+-}
+-
+-static inline void airtime_set_active(struct airtime_sched_info *air_sched,
+- struct airtime_info *air_info, u64 now)
+-{
+- air_info->last_scheduled = now;
+- air_sched->last_schedule_activity = now;
+- list_move_tail(&air_info->list, &air_sched->active_list);
+-}
+-
+-static inline bool airtime_catchup_v_t(struct airtime_sched_info *air_sched,
+- u64 v_t, u64 now)
+-{
+- air_sched->v_t = v_t;
+- return true;
+-}
+-
+-static inline void init_airtime_info(struct airtime_info *air_info,
+- struct airtime_sched_info *air_sched)
+-{
+- atomic_set(&air_info->aql_tx_pending, 0);
+- air_info->aql_limit_low = air_sched->aql_txq_limit_low;
+- air_info->aql_limit_high = air_sched->aql_txq_limit_high;
+- airtime_weight_set(air_info, IEEE80211_DEFAULT_AIRTIME_WEIGHT);
+- INIT_LIST_HEAD(&air_info->list);
+-}
+-
+ static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
+ {
+ return ether_addr_equal(raddr, addr) ||
+@@ -2024,14 +1874,6 @@ int ieee80211_tx_control_port(struct wip
+ u64 *cookie);
+ int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
+ const u8 *buf, size_t len);
+-void ieee80211_resort_txq(struct ieee80211_hw *hw,
+- struct ieee80211_txq *txq);
+-void ieee80211_unschedule_txq(struct ieee80211_hw *hw,
+- struct ieee80211_txq *txq,
+- bool purge);
+-void ieee80211_update_airtime_weight(struct ieee80211_local *local,
+- struct airtime_sched_info *air_sched,
+- u64 now, bool force);
+
+ /* HT */
+ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -2192,9 +2192,6 @@ int ieee80211_if_add(struct ieee80211_lo
+ }
+ }
+
+- for (i = 0; i < IEEE80211_NUM_ACS; i++)
+- init_airtime_info(&sdata->airtime[i], &local->airtime[i]);
+-
+ ieee80211_set_default_queues(sdata);
+
+ sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -707,13 +707,10 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ spin_lock_init(&local->queue_stop_reason_lock);
+
+ for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+- struct airtime_sched_info *air_sched = &local->airtime[i];
+-
+- air_sched->active_txqs = RB_ROOT_CACHED;
+- INIT_LIST_HEAD(&air_sched->active_list);
+- spin_lock_init(&air_sched->lock);
+- air_sched->aql_txq_limit_low = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
+- air_sched->aql_txq_limit_high =
++ INIT_LIST_HEAD(&local->active_txqs[i]);
++ spin_lock_init(&local->active_txq_lock[i]);
++ local->aql_txq_limit_low[i] = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
++ local->aql_txq_limit_high[i] =
+ IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H;
+ }
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1583,8 +1583,12 @@ static void sta_ps_start(struct sta_info
+
+ for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
+ struct ieee80211_txq *txq = sta->sta.txq[tid];
++ struct txq_info *txqi = to_txq_info(txq);
+
+- ieee80211_unschedule_txq(&local->hw, txq, false);
++ spin_lock(&local->active_txq_lock[txq->ac]);
++ if (!list_empty(&txqi->schedule_order))
++ list_del_init(&txqi->schedule_order);
++ spin_unlock(&local->active_txq_lock[txq->ac]);
+
+ if (txq_has_queue(txq))
+ set_bit(tid, &sta->txq_buffered_tids);
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -426,11 +426,15 @@ struct sta_info *sta_info_alloc(struct i
+ if (sta_prepare_rate_control(local, sta, gfp))
+ goto free_txq;
+
++ sta->airtime_weight = IEEE80211_DEFAULT_AIRTIME_WEIGHT;
+
+ for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+ skb_queue_head_init(&sta->ps_tx_buf[i]);
+ skb_queue_head_init(&sta->tx_filtered[i]);
+- init_airtime_info(&sta->airtime[i], &local->airtime[i]);
++ sta->airtime[i].deficit = sta->airtime_weight;
++ atomic_set(&sta->airtime[i].aql_tx_pending, 0);
++ sta->airtime[i].aql_limit_low = local->aql_txq_limit_low[i];
++ sta->airtime[i].aql_limit_high = local->aql_txq_limit_high[i];
+ }
+
+ for (i = 0; i < IEEE80211_NUM_TIDS; i++)
+@@ -1889,59 +1893,24 @@ void ieee80211_sta_set_buffered(struct i
+ }
+ EXPORT_SYMBOL(ieee80211_sta_set_buffered);
+
+-void ieee80211_register_airtime(struct ieee80211_txq *txq,
+- u32 tx_airtime, u32 rx_airtime)
++void ieee80211_sta_register_airtime(struct ieee80211_sta *pubsta, u8 tid,
++ u32 tx_airtime, u32 rx_airtime)
+ {
+- struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
+- struct ieee80211_local *local = sdata->local;
+- u64 weight_sum, weight_sum_reciprocal;
+- struct airtime_sched_info *air_sched;
+- struct airtime_info *air_info;
++ struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
++ struct ieee80211_local *local = sta->sdata->local;
++ u8 ac = ieee80211_ac_from_tid(tid);
+ u32 airtime = 0;
+
+- air_sched = &local->airtime[txq->ac];
+- air_info = to_airtime_info(txq);
+-
+- if (local->airtime_flags & AIRTIME_USE_TX)
++ if (sta->local->airtime_flags & AIRTIME_USE_TX)
+ airtime += tx_airtime;
+- if (local->airtime_flags & AIRTIME_USE_RX)
++ if (sta->local->airtime_flags & AIRTIME_USE_RX)
+ airtime += rx_airtime;
+
+- /* Weights scale so the unit weight is 256 */
+- airtime <<= 8;
+-
+- spin_lock_bh(&air_sched->lock);
+-
+- air_info->tx_airtime += tx_airtime;
+- air_info->rx_airtime += rx_airtime;
+-
+- if (air_sched->weight_sum) {
+- weight_sum = air_sched->weight_sum;
+- weight_sum_reciprocal = air_sched->weight_sum_reciprocal;
+- } else {
+- weight_sum = air_info->weight;
+- weight_sum_reciprocal = air_info->weight_reciprocal;
+- }
+-
+- /* Round the calculation of global vt */
+- air_sched->v_t += (u64)((airtime + (weight_sum >> 1)) *
+- weight_sum_reciprocal) >> IEEE80211_RECIPROCAL_SHIFT_64;
+- air_info->v_t += (u32)((airtime + (air_info->weight >> 1)) *
+- air_info->weight_reciprocal) >> IEEE80211_RECIPROCAL_SHIFT_32;
+- ieee80211_resort_txq(&local->hw, txq);
+-
+- spin_unlock_bh(&air_sched->lock);
+-}
+-
+-void ieee80211_sta_register_airtime(struct ieee80211_sta *pubsta, u8 tid,
+- u32 tx_airtime, u32 rx_airtime)
+-{
+- struct ieee80211_txq *txq = pubsta->txq[tid];
+-
+- if (!txq)
+- return;
+-
+- ieee80211_register_airtime(txq, tx_airtime, rx_airtime);
++ spin_lock_bh(&local->active_txq_lock[ac]);
++ sta->airtime[ac].tx_airtime += tx_airtime;
++ sta->airtime[ac].rx_airtime += rx_airtime;
++ sta->airtime[ac].deficit -= airtime;
++ spin_unlock_bh(&local->active_txq_lock[ac]);
+ }
+ EXPORT_SYMBOL(ieee80211_sta_register_airtime);
+
+@@ -2385,7 +2354,7 @@ void sta_set_sinfo(struct sta_info *sta,
+ }
+
+ if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT))) {
+- sinfo->airtime_weight = sta->airtime[0].weight;
++ sinfo->airtime_weight = sta->airtime_weight;
+ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT);
+ }
+
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -135,25 +135,18 @@ enum ieee80211_agg_stop_reason {
+ #define AIRTIME_USE_TX BIT(0)
+ #define AIRTIME_USE_RX BIT(1)
+
+-
+ struct airtime_info {
+ u64 rx_airtime;
+ u64 tx_airtime;
+- u64 v_t;
+- u64 last_scheduled;
+- struct list_head list;
++ s64 deficit;
+ atomic_t aql_tx_pending; /* Estimated airtime for frames pending */
+ u32 aql_limit_low;
+ u32 aql_limit_high;
+- u32 weight_reciprocal;
+- u16 weight;
+ };
+
+ void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local,
+ struct sta_info *sta, u8 ac,
+ u16 tx_airtime, bool tx_completed);
+-void ieee80211_register_airtime(struct ieee80211_txq *txq,
+- u32 tx_airtime, u32 rx_airtime);
+
+ struct sta_info;
+
+@@ -523,6 +516,7 @@ struct ieee80211_fragment_cache {
+ * @tid_seq: per-TID sequence numbers for sending to this STA
+ * @airtime: per-AC struct airtime_info describing airtime statistics for this
+ * station
++ * @airtime_weight: station weight for airtime fairness calculation purposes
+ * @ampdu_mlme: A-MPDU state machine state
+ * @mesh: mesh STA information
+ * @debugfs_dir: debug filesystem directory dentry
+@@ -653,6 +647,7 @@ struct sta_info {
+ u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
+
+ struct airtime_info airtime[IEEE80211_NUM_ACS];
++ u16 airtime_weight;
+
+ /*
+ * Aggregation information, locked with lock.
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -983,25 +983,6 @@ static void __ieee80211_tx_status(struct
+ if (!(info->flags & IEEE80211_TX_CTL_INJECTED) && acked)
+ ieee80211_frame_acked(sta, skb);
+
+- } else if (wiphy_ext_feature_isset(local->hw.wiphy,
+- NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) {
+- struct ieee80211_sub_if_data *sdata;
+- struct ieee80211_txq *txq;
+- u32 airtime;
+-
+- /* Account airtime to multicast queue */
+- sdata = ieee80211_sdata_from_skb(local, skb);
+-
+- if (sdata && (txq = sdata->vif.txq)) {
+- airtime = info->status.tx_time ?:
+- ieee80211_calc_expected_tx_airtime(hw,
+- &sdata->vif,
+- NULL,
+- skb->len,
+- false);
+-
+- ieee80211_register_airtime(txq, airtime, 0);
+- }
+ }
+
+ /* SNMP counters
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -18,7 +18,6 @@
+ #include <linux/bitmap.h>
+ #include <linux/rcupdate.h>
+ #include <linux/export.h>
+-#include <linux/timekeeping.h>
+ #include <net/net_namespace.h>
+ #include <net/ieee80211_radiotap.h>
+ #include <net/cfg80211.h>
+@@ -1480,7 +1479,7 @@ void ieee80211_txq_init(struct ieee80211
+ codel_vars_init(&txqi->def_cvars);
+ codel_stats_init(&txqi->cstats);
+ __skb_queue_head_init(&txqi->frags);
+- RB_CLEAR_NODE(&txqi->schedule_order);
++ INIT_LIST_HEAD(&txqi->schedule_order);
+
+ txqi->txq.vif = &sdata->vif;
+
+@@ -1524,7 +1523,9 @@ void ieee80211_txq_purge(struct ieee8021
+ ieee80211_purge_tx_queue(&local->hw, &txqi->frags);
+ spin_unlock_bh(&fq->lock);
+
+- ieee80211_unschedule_txq(&local->hw, &txqi->txq, true);
++ spin_lock_bh(&local->active_txq_lock[txqi->txq.ac]);
++ list_del_init(&txqi->schedule_order);
++ spin_unlock_bh(&local->active_txq_lock[txqi->txq.ac]);
+ }
+
+ void ieee80211_txq_set_params(struct ieee80211_local *local)
+@@ -3819,259 +3820,102 @@ EXPORT_SYMBOL(ieee80211_tx_dequeue);
+ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
+ {
+ struct ieee80211_local *local = hw_to_local(hw);
+- struct airtime_sched_info *air_sched;
+- u64 now = ktime_get_coarse_boottime_ns();
+ struct ieee80211_txq *ret = NULL;
+- struct airtime_info *air_info;
+- struct txq_info *txqi = NULL;
+- struct rb_node *node;
+- bool first = false;
++ struct txq_info *txqi = NULL, *head = NULL;
++ bool found_eligible_txq = false;
+
+- air_sched = &local->airtime[ac];
+- spin_lock_bh(&air_sched->lock);
++ spin_lock_bh(&local->active_txq_lock[ac]);
+
+- node = air_sched->schedule_pos;
+-
+-begin:
+- if (!node) {
+- node = rb_first_cached(&air_sched->active_txqs);
+- first = true;
+- } else {
+- node = rb_next(node);
+- }
+-
+- if (!node)
+- goto out;
+-
+- txqi = container_of(node, struct txq_info, schedule_order);
+- air_info = to_airtime_info(&txqi->txq);
+-
+- if (air_info->v_t > air_sched->v_t &&
+- (!first || !airtime_catchup_v_t(air_sched, air_info->v_t, now)))
++ begin:
++ txqi = list_first_entry_or_null(&local->active_txqs[ac],
++ struct txq_info,
++ schedule_order);
++ if (!txqi)
+ goto out;
+
+- if (!ieee80211_txq_airtime_check(hw, &txqi->txq)) {
+- first = false;
+- goto begin;
+- }
+-
+- air_sched->schedule_pos = node;
+- air_sched->last_schedule_activity = now;
+- ret = &txqi->txq;
+-out:
+- spin_unlock_bh(&air_sched->lock);
+- return ret;
+-}
+-EXPORT_SYMBOL(ieee80211_next_txq);
+-
+-static void __ieee80211_insert_txq(struct rb_root_cached *root,
+- struct txq_info *txqi)
+-{
+- struct rb_node **new = &root->rb_root.rb_node;
+- struct airtime_info *old_air, *new_air;
+- struct rb_node *parent = NULL;
+- struct txq_info *__txqi;
+- bool leftmost = true;
+-
+- while (*new) {
+- parent = *new;
+- __txqi = rb_entry(parent, struct txq_info, schedule_order);
+- old_air = to_airtime_info(&__txqi->txq);
+- new_air = to_airtime_info(&txqi->txq);
+-
+- if (new_air->v_t <= old_air->v_t) {
+- new = &parent->rb_left;
+- } else {
+- new = &parent->rb_right;
+- leftmost = false;
+- }
++ if (txqi == head) {
++ if (!found_eligible_txq)
++ goto out;
++ else
++ found_eligible_txq = false;
+ }
+
+- rb_link_node(&txqi->schedule_order, parent, new);
+- rb_insert_color_cached(&txqi->schedule_order, root, leftmost);
+-}
+-
+-void ieee80211_resort_txq(struct ieee80211_hw *hw,
+- struct ieee80211_txq *txq)
+-{
+- struct airtime_info *air_info = to_airtime_info(txq);
+- struct ieee80211_local *local = hw_to_local(hw);
+- struct txq_info *txqi = to_txq_info(txq);
+- struct airtime_sched_info *air_sched;
+-
+- air_sched = &local->airtime[txq->ac];
++ if (!head)
++ head = txqi;
+
+- lockdep_assert_held(&air_sched->lock);
+-
+- if (!RB_EMPTY_NODE(&txqi->schedule_order)) {
+- struct airtime_info *a_prev = NULL, *a_next = NULL;
+- struct txq_info *t_prev, *t_next;
+- struct rb_node *n_prev, *n_next;
++ if (txqi->txq.sta) {
++ struct sta_info *sta = container_of(txqi->txq.sta,
++ struct sta_info, sta);
++ bool aql_check = ieee80211_txq_airtime_check(hw, &txqi->txq);
++ s64 deficit = sta->airtime[txqi->txq.ac].deficit;
+
+- /* Erasing a node can cause an expensive rebalancing operation,
+- * so we check the previous and next nodes first and only remove
+- * and re-insert if the current node is not already in the
+- * correct position.
+- */
+- if ((n_prev = rb_prev(&txqi->schedule_order)) != NULL) {
+- t_prev = container_of(n_prev, struct txq_info,
+- schedule_order);
+- a_prev = to_airtime_info(&t_prev->txq);
+- }
++ if (aql_check)
++ found_eligible_txq = true;
+
+- if ((n_next = rb_next(&txqi->schedule_order)) != NULL) {
+- t_next = container_of(n_next, struct txq_info,
+- schedule_order);
+- a_next = to_airtime_info(&t_next->txq);
++ if (deficit < 0)
++ sta->airtime[txqi->txq.ac].deficit +=
++ sta->airtime_weight;
++
++ if (deficit < 0 || !aql_check) {
++ list_move_tail(&txqi->schedule_order,
++ &local->active_txqs[txqi->txq.ac]);
++ goto begin;
+ }
+-
+- if ((!a_prev || a_prev->v_t <= air_info->v_t) &&
+- (!a_next || a_next->v_t > air_info->v_t))
+- return;
+-
+- if (air_sched->schedule_pos == &txqi->schedule_order)
+- air_sched->schedule_pos = n_prev;
+-
+- rb_erase_cached(&txqi->schedule_order,
+- &air_sched->active_txqs);
+- RB_CLEAR_NODE(&txqi->schedule_order);
+- __ieee80211_insert_txq(&air_sched->active_txqs, txqi);
+ }
+-}
+-
+-void ieee80211_update_airtime_weight(struct ieee80211_local *local,
+- struct airtime_sched_info *air_sched,
+- u64 now, bool force)
+-{
+- struct airtime_info *air_info, *tmp;
+- u64 weight_sum = 0;
+-
+- if (unlikely(!now))
+- now = ktime_get_coarse_boottime_ns();
+-
+- lockdep_assert_held(&air_sched->lock);
+-
+- if (!force && (air_sched->last_weight_update <
+- now - AIRTIME_ACTIVE_DURATION))
+- return;
+-
+- list_for_each_entry_safe(air_info, tmp,
+- &air_sched->active_list, list) {
+- if (airtime_is_active(air_info, now))
+- weight_sum += air_info->weight;
+- else
+- list_del_init(&air_info->list);
+- }
+- airtime_weight_sum_set(air_sched, weight_sum);
+- air_sched->last_weight_update = now;
+-}
+
+-void ieee80211_schedule_txq(struct ieee80211_hw *hw,
+- struct ieee80211_txq *txq)
+- __acquires(txq_lock) __releases(txq_lock)
+-{
+- struct ieee80211_local *local = hw_to_local(hw);
+- struct txq_info *txqi = to_txq_info(txq);
+- struct airtime_sched_info *air_sched;
+- u64 now = ktime_get_coarse_boottime_ns();
+- struct airtime_info *air_info;
+- u8 ac = txq->ac;
+- bool was_active;
+
+- air_sched = &local->airtime[ac];
+- air_info = to_airtime_info(txq);
+-
+- spin_lock_bh(&air_sched->lock);
+- was_active = airtime_is_active(air_info, now);
+- airtime_set_active(air_sched, air_info, now);
+-
+- if (!RB_EMPTY_NODE(&txqi->schedule_order))
++ if (txqi->schedule_round == local->schedule_round[ac])
+ goto out;
+
+- /* If the station has been inactive for a while, catch up its v_t so it
+- * doesn't get indefinite priority; see comment above the definition of
+- * AIRTIME_MAX_BEHIND.
+- */
+- if ((!was_active && air_info->v_t < air_sched->v_t) ||
+- air_info->v_t < air_sched->v_t - AIRTIME_MAX_BEHIND)
+- air_info->v_t = air_sched->v_t;
+-
+- ieee80211_update_airtime_weight(local, air_sched, now, !was_active);
+- __ieee80211_insert_txq(&air_sched->active_txqs, txqi);
++ list_del_init(&txqi->schedule_order);
++ txqi->schedule_round = local->schedule_round[ac];
++ ret = &txqi->txq;
+
+ out:
+- spin_unlock_bh(&air_sched->lock);
+-}
+-EXPORT_SYMBOL(ieee80211_schedule_txq);
+-
+-static void __ieee80211_unschedule_txq(struct ieee80211_hw *hw,
+- struct ieee80211_txq *txq,
+- bool purge)
+-{
+- struct ieee80211_local *local = hw_to_local(hw);
+- struct txq_info *txqi = to_txq_info(txq);
+- struct airtime_sched_info *air_sched;
+- struct airtime_info *air_info;
+-
+- air_sched = &local->airtime[txq->ac];
+- air_info = to_airtime_info(&txqi->txq);
+-
+- lockdep_assert_held(&air_sched->lock);
+-
+- if (purge) {
+- list_del_init(&air_info->list);
+- ieee80211_update_airtime_weight(local, air_sched, 0, true);
+- }
+-
+- if (RB_EMPTY_NODE(&txqi->schedule_order))
+- return;
+-
+- if (air_sched->schedule_pos == &txqi->schedule_order)
+- air_sched->schedule_pos = rb_prev(&txqi->schedule_order);
+-
+- if (!purge)
+- airtime_set_active(air_sched, air_info,
+- ktime_get_coarse_boottime_ns());
+-
+- rb_erase_cached(&txqi->schedule_order,
+- &air_sched->active_txqs);
+- RB_CLEAR_NODE(&txqi->schedule_order);
++ spin_unlock_bh(&local->active_txq_lock[ac]);
++ return ret;
+ }
++EXPORT_SYMBOL(ieee80211_next_txq);
+
+-void ieee80211_unschedule_txq(struct ieee80211_hw *hw,
++void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
+ struct ieee80211_txq *txq,
+- bool purge)
+- __acquires(txq_lock) __releases(txq_lock)
+-{
+- struct ieee80211_local *local = hw_to_local(hw);
+-
+- spin_lock_bh(&local->airtime[txq->ac].lock);
+- __ieee80211_unschedule_txq(hw, txq, purge);
+- spin_unlock_bh(&local->airtime[txq->ac].lock);
+-}
+-
+-void ieee80211_return_txq(struct ieee80211_hw *hw,
+- struct ieee80211_txq *txq, bool force)
++ bool force)
+ {
+ struct ieee80211_local *local = hw_to_local(hw);
+ struct txq_info *txqi = to_txq_info(txq);
+
+- spin_lock_bh(&local->airtime[txq->ac].lock);
++ spin_lock_bh(&local->active_txq_lock[txq->ac]);
+
+- if (!RB_EMPTY_NODE(&txqi->schedule_order) && !force &&
+- !txq_has_queue(txq))
+- __ieee80211_unschedule_txq(hw, txq, false);
++ if (list_empty(&txqi->schedule_order) &&
++ (force || !skb_queue_empty(&txqi->frags) ||
++ txqi->tin.backlog_packets)) {
++ /* If airtime accounting is active, always enqueue STAs at the
++ * head of the list to ensure that they only get moved to the
++ * back by the airtime DRR scheduler once they have a negative
++ * deficit. A station that already has a negative deficit will
++ * get immediately moved to the back of the list on the next
++ * call to ieee80211_next_txq().
++ */
++ if (txqi->txq.sta && local->airtime_flags &&
++ wiphy_ext_feature_isset(local->hw.wiphy,
++ NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
++ list_add(&txqi->schedule_order,
++ &local->active_txqs[txq->ac]);
++ else
++ list_add_tail(&txqi->schedule_order,
++ &local->active_txqs[txq->ac]);
++ }
+
+- spin_unlock_bh(&local->airtime[txq->ac].lock);
++ spin_unlock_bh(&local->active_txq_lock[txq->ac]);
+ }
+-EXPORT_SYMBOL(ieee80211_return_txq);
++EXPORT_SYMBOL(__ieee80211_schedule_txq);
+
+ DEFINE_STATIC_KEY_FALSE(aql_disable);
+
+ bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
+ struct ieee80211_txq *txq)
+ {
+- struct airtime_info *air_info = to_airtime_info(txq);
++ struct sta_info *sta;
+ struct ieee80211_local *local = hw_to_local(hw);
+
+ if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
+@@ -4086,12 +3930,15 @@ bool ieee80211_txq_airtime_check(struct
+ if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
+ return true;
+
+- if (atomic_read(&air_info->aql_tx_pending) < air_info->aql_limit_low)
++ sta = container_of(txq->sta, struct sta_info, sta);
++ if (atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
++ sta->airtime[txq->ac].aql_limit_low)
+ return true;
+
+ if (atomic_read(&local->aql_total_pending_airtime) <
+ local->aql_threshold &&
+- atomic_read(&air_info->aql_tx_pending) < air_info->aql_limit_high)
++ atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
++ sta->airtime[txq->ac].aql_limit_high)
+ return true;
+
+ return false;
+@@ -4101,59 +3948,60 @@ EXPORT_SYMBOL(ieee80211_txq_airtime_chec
+ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
+ struct ieee80211_txq *txq)
+ {
+- struct txq_info *first_txqi = NULL, *txqi = to_txq_info(txq);
+ struct ieee80211_local *local = hw_to_local(hw);
+- struct airtime_sched_info *air_sched;
+- struct airtime_info *air_info;
+- struct rb_node *node = NULL;
+- bool ret = false;
+- u64 now;
+-
++ struct txq_info *iter, *tmp, *txqi = to_txq_info(txq);
++ struct sta_info *sta;
++ u8 ac = txq->ac;
+
+- if (!ieee80211_txq_airtime_check(hw, txq))
+- return false;
++ spin_lock_bh(&local->active_txq_lock[ac]);
+
+- air_sched = &local->airtime[txq->ac];
+- spin_lock_bh(&air_sched->lock);
++ if (!txqi->txq.sta)
++ goto out;
+
+- if (RB_EMPTY_NODE(&txqi->schedule_order))
++ if (list_empty(&txqi->schedule_order))
+ goto out;
+
+- now = ktime_get_coarse_boottime_ns();
++ list_for_each_entry_safe(iter, tmp, &local->active_txqs[ac],
++ schedule_order) {
++ if (iter == txqi)
++ break;
+
+- /* Like in ieee80211_next_txq(), make sure the first station in the
+- * scheduling order is eligible for transmission to avoid starvation.
+- */
+- node = rb_first_cached(&air_sched->active_txqs);
+- if (node) {
+- first_txqi = container_of(node, struct txq_info,
+- schedule_order);
+- air_info = to_airtime_info(&first_txqi->txq);
+-
+- if (air_sched->v_t < air_info->v_t)
+- airtime_catchup_v_t(air_sched, air_info->v_t, now);
++ if (!iter->txq.sta) {
++ list_move_tail(&iter->schedule_order,
++ &local->active_txqs[ac]);
++ continue;
++ }
++ sta = container_of(iter->txq.sta, struct sta_info, sta);
++ if (sta->airtime[ac].deficit < 0)
++ sta->airtime[ac].deficit += sta->airtime_weight;
++ list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
+ }
+
+- air_info = to_airtime_info(&txqi->txq);
+- if (air_info->v_t <= air_sched->v_t) {
+- air_sched->last_schedule_activity = now;
+- ret = true;
+- }
++ sta = container_of(txqi->txq.sta, struct sta_info, sta);
++ if (sta->airtime[ac].deficit >= 0)
++ goto out;
++
++ sta->airtime[ac].deficit += sta->airtime_weight;
++ list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
++ spin_unlock_bh(&local->active_txq_lock[ac]);
+
++ return false;
+ out:
+- spin_unlock_bh(&air_sched->lock);
+- return ret;
++ if (!list_empty(&txqi->schedule_order))
++ list_del_init(&txqi->schedule_order);
++ spin_unlock_bh(&local->active_txq_lock[ac]);
++
++ return true;
+ }
+ EXPORT_SYMBOL(ieee80211_txq_may_transmit);
+
+ void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
+ {
+ struct ieee80211_local *local = hw_to_local(hw);
+- struct airtime_sched_info *air_sched = &local->airtime[ac];
+
+- spin_lock_bh(&air_sched->lock);
+- air_sched->schedule_pos = NULL;
+- spin_unlock_bh(&air_sched->lock);
++ spin_lock_bh(&local->active_txq_lock[ac]);
++ local->schedule_round[ac]++;
++ spin_unlock_bh(&local->active_txq_lock[ac]);
+ }
+ EXPORT_SYMBOL(ieee80211_txq_schedule_start);
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/331-v6.0-mac80211-make-sta-airtime-deficit-field-s32-instead-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/331-v6.0-mac80211-make-sta-airtime-deficit-field-s32-instead-.patch
new file mode 100644
index 0000000..c006d37
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/331-v6.0-mac80211-make-sta-airtime-deficit-field-s32-instead-.patch
@@ -0,0 +1,52 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Jun 2022 14:53:04 +0200
+Subject: [PATCH] mac80211: make sta airtime deficit field s32 instead of
+ s64
+
+32 bit is more than enough range for the airtime deficit
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -202,7 +202,7 @@ static ssize_t sta_airtime_read(struct f
+ size_t bufsz = 400;
+ char *buf = kzalloc(bufsz, GFP_KERNEL), *p = buf;
+ u64 rx_airtime = 0, tx_airtime = 0;
+- s64 deficit[IEEE80211_NUM_ACS];
++ s32 deficit[IEEE80211_NUM_ACS];
+ ssize_t rv;
+ int ac;
+
+@@ -219,7 +219,7 @@ static ssize_t sta_airtime_read(struct f
+
+ p += scnprintf(p, bufsz + buf - p,
+ "RX: %llu us\nTX: %llu us\nWeight: %u\n"
+- "Deficit: VO: %lld us VI: %lld us BE: %lld us BK: %lld us\n",
++ "Deficit: VO: %d us VI: %d us BE: %d us BK: %d us\n",
+ rx_airtime, tx_airtime, sta->airtime_weight,
+ deficit[0], deficit[1], deficit[2], deficit[3]);
+
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -138,7 +138,7 @@ enum ieee80211_agg_stop_reason {
+ struct airtime_info {
+ u64 rx_airtime;
+ u64 tx_airtime;
+- s64 deficit;
++ s32 deficit;
+ atomic_t aql_tx_pending; /* Estimated airtime for frames pending */
+ u32 aql_limit_low;
+ u32 aql_limit_high;
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3847,7 +3847,7 @@ struct ieee80211_txq *ieee80211_next_txq
+ struct sta_info *sta = container_of(txqi->txq.sta,
+ struct sta_info, sta);
+ bool aql_check = ieee80211_txq_airtime_check(hw, &txqi->txq);
+- s64 deficit = sta->airtime[txqi->txq.ac].deficit;
++ s32 deficit = sta->airtime[txqi->txq.ac].deficit;
+
+ if (aql_check)
+ found_eligible_txq = true;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/332-v6.0-mac80211-consider-aql_tx_pending-when-checking-airti.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/332-v6.0-mac80211-consider-aql_tx_pending-when-checking-airti.patch
new file mode 100644
index 0000000..c214294
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/332-v6.0-mac80211-consider-aql_tx_pending-when-checking-airti.patch
@@ -0,0 +1,48 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Jun 2022 14:59:09 +0200
+Subject: [PATCH] mac80211: consider aql_tx_pending when checking airtime
+ deficit
+
+When queueing packets for a station, deficit only gets added once the packets
+have been transmitted, which could be much later. During that time, a lot of
+temporary unfairness could happen, which could lead to bursty behavior.
+Fix this by subtracting the aql_tx_pending when checking the deficit in tx
+scheduling.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3817,6 +3817,13 @@ out:
+ }
+ EXPORT_SYMBOL(ieee80211_tx_dequeue);
+
++static inline s32 ieee80211_sta_deficit(struct sta_info *sta, u8 ac)
++{
++ struct airtime_info *air_info = &sta->airtime[ac];
++
++ return air_info->deficit - atomic_read(&air_info->aql_tx_pending);
++}
++
+ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
+ {
+ struct ieee80211_local *local = hw_to_local(hw);
+@@ -3847,7 +3854,7 @@ struct ieee80211_txq *ieee80211_next_txq
+ struct sta_info *sta = container_of(txqi->txq.sta,
+ struct sta_info, sta);
+ bool aql_check = ieee80211_txq_airtime_check(hw, &txqi->txq);
+- s32 deficit = sta->airtime[txqi->txq.ac].deficit;
++ s32 deficit = ieee80211_sta_deficit(sta, txqi->txq.ac);
+
+ if (aql_check)
+ found_eligible_txq = true;
+@@ -3972,7 +3979,7 @@ bool ieee80211_txq_may_transmit(struct i
+ continue;
+ }
+ sta = container_of(iter->txq.sta, struct sta_info, sta);
+- if (sta->airtime[ac].deficit < 0)
++ if (ieee80211_sta_deficit(sta, ac) < 0)
+ sta->airtime[ac].deficit += sta->airtime_weight;
+ list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
+ }
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/333-v6.0-mac80211-keep-recently-active-tx-queues-in-schedulin.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/333-v6.0-mac80211-keep-recently-active-tx-queues-in-schedulin.patch
new file mode 100644
index 0000000..317e4f0
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/333-v6.0-mac80211-keep-recently-active-tx-queues-in-schedulin.patch
@@ -0,0 +1,118 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Jun 2022 20:52:50 +0200
+Subject: [PATCH] mac80211: keep recently active tx queues in scheduling
+ list
+
+This allows proper deficit accounting to ensure that they don't carry their
+deficit until the next time they become active
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -83,6 +83,13 @@ extern const u8 ieee80211_ac_to_qos_mask
+
+ #define IEEE80211_MAX_NAN_INSTANCE_ID 255
+
++
++/*
++ * Keep a station's queues on the active list for deficit accounting purposes
++ * if it was active or queued during the last 100ms
++ */
++#define AIRTIME_ACTIVE_DURATION (HZ / 10)
++
+ struct ieee80211_bss {
+ u32 device_ts_beacon, device_ts_presp;
+
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -138,6 +138,7 @@ enum ieee80211_agg_stop_reason {
+ struct airtime_info {
+ u64 rx_airtime;
+ u64 tx_airtime;
++ u32 last_active;
+ s32 deficit;
+ atomic_t aql_tx_pending; /* Estimated airtime for frames pending */
+ u32 aql_limit_low;
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3824,6 +3824,36 @@ static inline s32 ieee80211_sta_deficit(
+ return air_info->deficit - atomic_read(&air_info->aql_tx_pending);
+ }
+
++static void
++ieee80211_txq_set_active(struct txq_info *txqi)
++{
++ struct sta_info *sta;
++
++ if (!txqi->txq.sta)
++ return;
++
++ sta = container_of(txqi->txq.sta, struct sta_info, sta);
++ sta->airtime[txqi->txq.ac].last_active = (u32)jiffies;
++}
++
++static bool
++ieee80211_txq_keep_active(struct txq_info *txqi)
++{
++ struct sta_info *sta;
++ u32 diff;
++
++ if (!txqi->txq.sta)
++ return false;
++
++ sta = container_of(txqi->txq.sta, struct sta_info, sta);
++ if (ieee80211_sta_deficit(sta, txqi->txq.ac) >= 0)
++ return false;
++
++ diff = (u32)jiffies - sta->airtime[txqi->txq.ac].last_active;
++
++ return diff <= AIRTIME_ACTIVE_DURATION;
++}
++
+ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
+ {
+ struct ieee80211_local *local = hw_to_local(hw);
+@@ -3870,7 +3900,6 @@ struct ieee80211_txq *ieee80211_next_txq
+ }
+ }
+
+-
+ if (txqi->schedule_round == local->schedule_round[ac])
+ goto out;
+
+@@ -3890,12 +3919,13 @@ void __ieee80211_schedule_txq(struct iee
+ {
+ struct ieee80211_local *local = hw_to_local(hw);
+ struct txq_info *txqi = to_txq_info(txq);
++ bool has_queue;
+
+ spin_lock_bh(&local->active_txq_lock[txq->ac]);
+
++ has_queue = force || txq_has_queue(txq);
+ if (list_empty(&txqi->schedule_order) &&
+- (force || !skb_queue_empty(&txqi->frags) ||
+- txqi->tin.backlog_packets)) {
++ (has_queue || ieee80211_txq_keep_active(txqi))) {
+ /* If airtime accounting is active, always enqueue STAs at the
+ * head of the list to ensure that they only get moved to the
+ * back by the airtime DRR scheduler once they have a negative
+@@ -3903,7 +3933,7 @@ void __ieee80211_schedule_txq(struct iee
+ * get immediately moved to the back of the list on the next
+ * call to ieee80211_next_txq().
+ */
+- if (txqi->txq.sta && local->airtime_flags &&
++ if (txqi->txq.sta && local->airtime_flags && has_queue &&
+ wiphy_ext_feature_isset(local->hw.wiphy,
+ NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
+ list_add(&txqi->schedule_order,
+@@ -3911,6 +3941,8 @@ void __ieee80211_schedule_txq(struct iee
+ else
+ list_add_tail(&txqi->schedule_order,
+ &local->active_txqs[txq->ac]);
++ if (has_queue)
++ ieee80211_txq_set_active(txqi);
+ }
+
+ spin_unlock_bh(&local->active_txq_lock[txq->ac]);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/334-v6.0-mac80211-add-a-per-PHY-AQL-limit-to-improve-fairness.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/334-v6.0-mac80211-add-a-per-PHY-AQL-limit-to-improve-fairness.patch
new file mode 100644
index 0000000..fb6fd6e
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/334-v6.0-mac80211-add-a-per-PHY-AQL-limit-to-improve-fairness.patch
@@ -0,0 +1,131 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Jun 2022 21:26:34 +0200
+Subject: [PATCH] mac80211: add a per-PHY AQL limit to improve fairness
+
+In order to maintain fairness, the amount of queueing needs to be limited
+beyond the simple per-station AQL budget, otherwise the driver can simply
+repeatedly do scheduling rounds until all queues that have not used their
+AQL budget become eligble.
+
+To be conservative, use the high AQL limit for the first txq and add half
+of the low AQL for each subsequent queue.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1215,6 +1215,7 @@ struct ieee80211_local {
+ u32 aql_txq_limit_high[IEEE80211_NUM_ACS];
+ u32 aql_threshold;
+ atomic_t aql_total_pending_airtime;
++ atomic_t aql_ac_pending_airtime[IEEE80211_NUM_ACS];
+
+ const struct ieee80211_ops *ops;
+
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -712,6 +712,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ local->aql_txq_limit_low[i] = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
+ local->aql_txq_limit_high[i] =
+ IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H;
++ atomic_set(&local->aql_ac_pending_airtime[i], 0);
+ }
+
+ local->airtime_flags = AIRTIME_USE_TX | AIRTIME_USE_RX;
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1929,6 +1929,7 @@ void ieee80211_sta_update_pending_airtim
+ &sta->airtime[ac].aql_tx_pending);
+
+ atomic_add(tx_airtime, &local->aql_total_pending_airtime);
++ atomic_add(tx_airtime, &local->aql_ac_pending_airtime[ac]);
+ return;
+ }
+
+@@ -1940,14 +1941,17 @@ void ieee80211_sta_update_pending_airtim
+ tx_pending, 0);
+ }
+
++ atomic_sub(tx_airtime, &local->aql_total_pending_airtime);
+ tx_pending = atomic_sub_return(tx_airtime,
+- &local->aql_total_pending_airtime);
++ &local->aql_ac_pending_airtime[ac]);
+ if (WARN_ONCE(tx_pending < 0,
+ "Device %s AC %d pending airtime underflow: %u, %u",
+ wiphy_name(local->hw.wiphy), ac, tx_pending,
+- tx_airtime))
+- atomic_cmpxchg(&local->aql_total_pending_airtime,
++ tx_airtime)) {
++ atomic_cmpxchg(&local->aql_ac_pending_airtime[ac],
+ tx_pending, 0);
++ atomic_sub(tx_pending, &local->aql_total_pending_airtime);
++ }
+ }
+
+ int sta_info_move_state(struct sta_info *sta,
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3863,6 +3863,9 @@ struct ieee80211_txq *ieee80211_next_txq
+
+ spin_lock_bh(&local->active_txq_lock[ac]);
+
++ if (!local->schedule_round[ac])
++ goto out;
++
+ begin:
+ txqi = list_first_entry_or_null(&local->active_txqs[ac],
+ struct txq_info,
+@@ -3984,6 +3987,25 @@ bool ieee80211_txq_airtime_check(struct
+ }
+ EXPORT_SYMBOL(ieee80211_txq_airtime_check);
+
++static bool
++ieee80211_txq_schedule_airtime_check(struct ieee80211_local *local, u8 ac)
++{
++ unsigned int num_txq = 0;
++ struct txq_info *txq;
++ u32 aql_limit;
++
++ if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
++ return true;
++
++ list_for_each_entry(txq, &local->active_txqs[ac], schedule_order)
++ num_txq++;
++
++ aql_limit = (num_txq - 1) * local->aql_txq_limit_low[ac] / 2 +
++ local->aql_txq_limit_high[ac];
++
++ return atomic_read(&local->aql_ac_pending_airtime[ac]) < aql_limit;
++}
++
+ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
+ struct ieee80211_txq *txq)
+ {
+@@ -4000,6 +4022,9 @@ bool ieee80211_txq_may_transmit(struct i
+ if (list_empty(&txqi->schedule_order))
+ goto out;
+
++ if (!ieee80211_txq_schedule_airtime_check(local, ac))
++ goto out;
++
+ list_for_each_entry_safe(iter, tmp, &local->active_txqs[ac],
+ schedule_order) {
+ if (iter == txqi)
+@@ -4039,7 +4064,15 @@ void ieee80211_txq_schedule_start(struct
+ struct ieee80211_local *local = hw_to_local(hw);
+
+ spin_lock_bh(&local->active_txq_lock[ac]);
+- local->schedule_round[ac]++;
++
++ if (ieee80211_txq_schedule_airtime_check(local, ac)) {
++ local->schedule_round[ac]++;
++ if (!local->schedule_round[ac])
++ local->schedule_round[ac]++;
++ } else {
++ local->schedule_round[ac] = 0;
++ }
++
+ spin_unlock_bh(&local->active_txq_lock[ac]);
+ }
+ EXPORT_SYMBOL(ieee80211_txq_schedule_start);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/335-v6.0-mac80211-add-debugfs-file-to-display-per-phy-AQL-pen.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/335-v6.0-mac80211-add-debugfs-file-to-display-per-phy-AQL-pen.patch
new file mode 100644
index 0000000..df45a52
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/335-v6.0-mac80211-add-debugfs-file-to-display-per-phy-AQL-pen.patch
@@ -0,0 +1,58 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 25 Jun 2022 21:25:40 +0200
+Subject: [PATCH] mac80211: add debugfs file to display per-phy AQL pending
+ airtime
+
+Now that the global pending airtime is more relevant for airtime fairness,
+it makes sense to make it accessible via debugfs for debugging
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -201,6 +201,36 @@ static const struct file_operations airt
+ .llseek = default_llseek,
+ };
+
++static ssize_t aql_pending_read(struct file *file,
++ char __user *user_buf,
++ size_t count, loff_t *ppos)
++{
++ struct ieee80211_local *local = file->private_data;
++ char buf[400];
++ int len = 0;
++
++ len = scnprintf(buf, sizeof(buf),
++ "AC AQL pending\n"
++ "VO %u us\n"
++ "VI %u us\n"
++ "BE %u us\n"
++ "BK %u us\n"
++ "total %u us\n",
++ atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_VO]),
++ atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_VI]),
++ atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_BE]),
++ atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_BK]),
++ atomic_read(&local->aql_total_pending_airtime));
++ return simple_read_from_buffer(user_buf, count, ppos,
++ buf, len);
++}
++
++static const struct file_operations aql_pending_ops = {
++ .read = aql_pending_read,
++ .open = simple_open,
++ .llseek = default_llseek,
++};
++
+ static ssize_t aql_txq_limit_read(struct file *file,
+ char __user *user_buf,
+ size_t count,
+@@ -628,6 +658,7 @@ void debugfs_hw_add(struct ieee80211_loc
+ DEBUGFS_ADD(hw_conf);
+ DEBUGFS_ADD_MODE(force_tx_status, 0600);
+ DEBUGFS_ADD_MODE(aql_enable, 0600);
++ DEBUGFS_ADD(aql_pending);
+
+ if (local->ops->wake_tx_queue)
+ DEBUGFS_ADD_MODE(aqm, 0600);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/336-v6.0-mac80211-only-accumulate-airtime-deficit-for-active-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/336-v6.0-mac80211-only-accumulate-airtime-deficit-for-active-.patch
new file mode 100644
index 0000000..35f07c1
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/336-v6.0-mac80211-only-accumulate-airtime-deficit-for-active-.patch
@@ -0,0 +1,36 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 25 Jun 2022 23:10:19 +0200
+Subject: [PATCH] mac80211: only accumulate airtime deficit for active
+ clients
+
+When a client does not generate any local tx activity, accumulating airtime
+deficit for the round-robin scheduler can be harmful. If this goes on for too
+long, the deficit could grow quite large, which might cause unreasonable
+initial latency once the client becomes active
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1900,6 +1900,7 @@ void ieee80211_sta_register_airtime(stru
+ struct ieee80211_local *local = sta->sdata->local;
+ u8 ac = ieee80211_ac_from_tid(tid);
+ u32 airtime = 0;
++ u32 diff;
+
+ if (sta->local->airtime_flags & AIRTIME_USE_TX)
+ airtime += tx_airtime;
+@@ -1909,7 +1910,11 @@ void ieee80211_sta_register_airtime(stru
+ spin_lock_bh(&local->active_txq_lock[ac]);
+ sta->airtime[ac].tx_airtime += tx_airtime;
+ sta->airtime[ac].rx_airtime += rx_airtime;
+- sta->airtime[ac].deficit -= airtime;
++
++ diff = (u32)jiffies - sta->airtime[ac].last_active;
++ if (diff <= AIRTIME_ACTIVE_DURATION)
++ sta->airtime[ac].deficit -= airtime;
++
+ spin_unlock_bh(&local->active_txq_lock[ac]);
+ }
+ EXPORT_SYMBOL(ieee80211_sta_register_airtime);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/337-mac80211-increase-quantum-for-airtime-scheduler.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/337-mac80211-increase-quantum-for-airtime-scheduler.patch
new file mode 100644
index 0000000..74e8576
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/337-mac80211-increase-quantum-for-airtime-scheduler.patch
@@ -0,0 +1,53 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 26 Jun 2022 11:43:25 +0200
+Subject: [PATCH] mac80211: increase quantum for airtime scheduler
+
+Given the typical AQL budget and queue length, a quantum of 256 with the
+default station weight often requires iterating over all queues frequently,
+until one of them becomes eligible.
+Improve performance by using 8 times station weight as scheduler quantum
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -90,6 +90,8 @@ extern const u8 ieee80211_ac_to_qos_mask
+ */
+ #define AIRTIME_ACTIVE_DURATION (HZ / 10)
+
++#define AIRTIME_QUANTUM_SHIFT 3
++
+ struct ieee80211_bss {
+ u32 device_ts_beacon, device_ts_presp;
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3894,7 +3894,7 @@ struct ieee80211_txq *ieee80211_next_txq
+
+ if (deficit < 0)
+ sta->airtime[txqi->txq.ac].deficit +=
+- sta->airtime_weight;
++ sta->airtime_weight << AIRTIME_QUANTUM_SHIFT;
+
+ if (deficit < 0 || !aql_check) {
+ list_move_tail(&txqi->schedule_order,
+@@ -4037,7 +4037,8 @@ bool ieee80211_txq_may_transmit(struct i
+ }
+ sta = container_of(iter->txq.sta, struct sta_info, sta);
+ if (ieee80211_sta_deficit(sta, ac) < 0)
+- sta->airtime[ac].deficit += sta->airtime_weight;
++ sta->airtime[ac].deficit += sta->airtime_weight <<
++ AIRTIME_QUANTUM_SHIFT;
+ list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
+ }
+
+@@ -4045,7 +4046,7 @@ bool ieee80211_txq_may_transmit(struct i
+ if (sta->airtime[ac].deficit >= 0)
+ goto out;
+
+- sta->airtime[ac].deficit += sta->airtime_weight;
++ sta->airtime[ac].deficit += sta->airtime_weight << AIRTIME_QUANTUM_SHIFT;
+ list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
+ spin_unlock_bh(&local->active_txq_lock[ac]);
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/339-v6.0-mac80211-exclude-multicast-packets-from-AQL-pending-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/339-v6.0-mac80211-exclude-multicast-packets-from-AQL-pending-.patch
new file mode 100644
index 0000000..43c3e75
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/339-v6.0-mac80211-exclude-multicast-packets-from-AQL-pending-.patch
@@ -0,0 +1,30 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 13 Jul 2022 07:32:26 +0200
+Subject: [PATCH] mac80211: exclude multicast packets from AQL pending airtime
+
+In AP mode, multicast traffic is handled very differently from normal traffic,
+especially if at least one client is in powersave mode.
+This means that multicast packets can be buffered a lot longer than normal
+unicast packets, and can eat up the AQL budget very quickly because of the low
+data rate.
+Along with the recent change to maintain a global PHY AQL limit, this can lead
+to significant latency spikes for unicast traffic.
+
+Since queueing multicast to hardware is currently not constrained by AQL limits
+anyway, let's just exclude it from the AQL pending airtime calculation entirely.
+
+Fixes: 8e4bac067105 ("wifi: mac80211: add a per-PHY AQL limit to improve fairness")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3792,7 +3792,7 @@ begin:
+ encap_out:
+ IEEE80211_SKB_CB(skb)->control.vif = vif;
+
+- if (vif &&
++ if (tx.sta &&
+ wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL)) {
+ bool ampdu = txq->ac != IEEE80211_AC_VO;
+ u32 airtime;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/340-v5.19-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/340-v5.19-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch
new file mode 100644
index 0000000..82243f1
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/340-v5.19-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch
@@ -0,0 +1,46 @@
+From aa40d5a43526cca9439a2b45fcfdcd016594dece Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Sun, 17 Jul 2022 21:21:52 +0900
+Subject: [PATCH] wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+lockdep complains use of uninitialized spinlock at ieee80211_do_stop() [1],
+for commit f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif
+that is being stopped") guards clear_bit() using fq.lock even before
+fq_init() from ieee80211_txq_setup_flows() initializes this spinlock.
+
+According to discussion [2], Toke was not happy with expanding usage of
+fq.lock. Since __ieee80211_wake_txqs() is called under RCU read lock, we
+can instead use synchronize_rcu() for flushing ieee80211_wake_txqs().
+
+Link: https://syzkaller.appspot.com/bug?extid=eceab52db7c4b961e9d6 [1]
+Link: https://lkml.kernel.org/r/874k0zowh2.fsf@toke.dk [2]
+Reported-by: syzbot <syzbot+eceab52db7c4b961e9d6@syzkaller.appspotmail.com>
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Fixes: f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif that is being stopped")
+Tested-by: syzbot <syzbot+eceab52db7c4b961e9d6@syzkaller.appspotmail.com>
+Acked-by: Toke Høiland-Jørgensen <toke@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/9cc9b81d-75a3-3925-b612-9d0ad3cab82b@I-love.SAKURA.ne.jp
+[ pick up commit 3598cb6e1862 ("wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()") from -next]
+Link: https://lore.kernel.org/all/87o7xcq6qt.fsf@kernel.org/
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ net/mac80211/iface.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -377,9 +377,8 @@ static void ieee80211_do_stop(struct iee
+ bool cancel_scan;
+ struct cfg80211_nan_func *func;
+
+- spin_lock_bh(&local->fq.lock);
+ clear_bit(SDATA_STATE_RUNNING, &sdata->state);
+- spin_unlock_bh(&local->fq.lock);
++ synchronize_rcu(); /* flush _ieee80211_wake_txqs() */
+
+ cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
+ if (cancel_scan)
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/341-v6.0-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/341-v6.0-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch
new file mode 100644
index 0000000..8c56acb
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/341-v6.0-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch
@@ -0,0 +1,40 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Thu, 15 Sep 2022 14:41:20 +0200
+Subject: [PATCH] mac80211: Fix deadlock: Don't start TX while holding
+ fq->lock
+
+ieee80211_txq_purge() calls fq_tin_reset() and
+ieee80211_purge_tx_queue(); Both are then calling
+ieee80211_free_txskb(). Which can decide to TX the skb again.
+
+There are at least two ways to get a deadlock:
+
+1) When we have a TDLS teardown packet queued in either tin or frags
+ ieee80211_tdls_td_tx_handle() will call ieee80211_subif_start_xmit()
+ while we still hold fq->lock. ieee80211_txq_enqueue() will thus
+ deadlock.
+
+2) A variant of the above happens if aggregation is up and running:
+ In that case ieee80211_iface_work() will deadlock with the original
+ task: The original tasks already holds fq->lock and tries to get
+ sta->lock after kicking off ieee80211_iface_work(). But the worker
+ can get sta->lock prior to the original task and will then spin for
+ fq->lock.
+
+Avoid these deadlocks by not sending out any skbs when called via
+ieee80211_free_txskb().
+
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+---
+
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -698,7 +698,7 @@ static void ieee80211_report_used_skb(st
+
+ if (!sdata) {
+ skb->dev = NULL;
+- } else {
++ } else if (!dropped) {
+ unsigned int hdr_size =
+ ieee80211_hdrlen(hdr->frame_control);
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/342-v6.0-mac80211-Ensure-vif-queues-are-operational-after-sta.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/342-v6.0-mac80211-Ensure-vif-queues-are-operational-after-sta.patch
new file mode 100644
index 0000000..4310329
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/342-v6.0-mac80211-Ensure-vif-queues-are-operational-after-sta.patch
@@ -0,0 +1,47 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Thu, 15 Sep 2022 15:09:46 +0200
+Subject: [PATCH] mac80211: Ensure vif queues are operational after start
+
+Make sure local->queue_stop_reasons and vif.txqs_stopped stay in sync.
+
+When a new vif is created the queues may end up in an inconsistent state
+and be inoperable:
+Communication not using iTXQ will work, allowing to e.g. complete the
+association. But the 4-way handshake will time out. The sta will not
+send out any skbs queued in iTXQs.
+
+All normal attempts to start the queues will fail when reaching this
+state.
+local->queue_stop_reasons will have marked all queues as operational but
+vif.txqs_stopped will still be set, creating an inconsistent internal
+state.
+
+In reality this seems to be race between the mac80211 function
+ieee80211_do_open() setting SDATA_STATE_RUNNING and the wake_txqs_tasklet:
+Depending on the driver and the timing the queues may end up to be
+operational or not.
+
+Cc: stable@vger.kernel.org
+Fixes: f856373e2f31 ("wifi: mac80211: do not wake queues on a vif that is being stopped")
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+---
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -301,14 +301,14 @@ static void __ieee80211_wake_txqs(struct
+ local_bh_disable();
+ spin_lock(&fq->lock);
+
++ sdata->vif.txqs_stopped[ac] = false;
++
+ if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
+ goto out;
+
+ if (sdata->vif.type == NL80211_IFTYPE_AP)
+ ps = &sdata->bss->ps;
+
+- sdata->vif.txqs_stopped[ac] = false;
+-
+ list_for_each_entry_rcu(sta, &local->sta_list, list) {
+ if (sdata != sta->sdata)
+ continue;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/343-v6.1-wifi-mac80211-fix-decap-offload-for-stations-on-AP_V.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/343-v6.1-wifi-mac80211-fix-decap-offload-for-stations-on-AP_V.patch
new file mode 100644
index 0000000..0246785
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/343-v6.1-wifi-mac80211-fix-decap-offload-for-stations-on-AP_V.patch
@@ -0,0 +1,37 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 28 Sep 2022 13:50:34 +0200
+Subject: [PATCH] wifi: mac80211: fix decap offload for stations on AP_VLAN
+ interfaces
+
+Since AP_VLAN interfaces are not passed to the driver, check offload_flags
+on the bss vif instead.
+
+Reported-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+Fixes: 80a915ec4427 ("mac80211: add rx decapsulation offload support")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4267,6 +4267,7 @@ void ieee80211_check_fast_rx(struct sta_
+ .vif_type = sdata->vif.type,
+ .control_port_protocol = sdata->control_port_protocol,
+ }, *old, *new = NULL;
++ u32 offload_flags;
+ bool set_offload = false;
+ bool assign = false;
+ bool offload;
+@@ -4382,10 +4383,10 @@ void ieee80211_check_fast_rx(struct sta_
+ if (assign)
+ new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
+
+- offload = assign &&
+- (sdata->vif.offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED);
++ offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
++ offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
+
+- if (offload)
++ if (assign && offload)
+ set_offload = !test_and_set_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
+ else
+ set_offload = test_and_clear_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/344-v6.1-wifi-cfg80211-fix-ieee80211_data_to_8023_exthdr-hand.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/344-v6.1-wifi-cfg80211-fix-ieee80211_data_to_8023_exthdr-hand.patch
new file mode 100644
index 0000000..161c7d6
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/344-v6.1-wifi-cfg80211-fix-ieee80211_data_to_8023_exthdr-hand.patch
@@ -0,0 +1,99 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Oct 2022 10:54:47 +0200
+Subject: [PATCH] wifi: cfg80211: fix ieee80211_data_to_8023_exthdr
+ handling of small packets
+
+STP topology change notification packets only have a payload of 7 bytes,
+so they get dropped due to the skb->len < hdrlen + 8 check.
+Fix this by removing skb->len based checks and instead check the return code
+on the skb_copy_bits calls.
+
+Fixes: 2d1c304cb2d5 ("cfg80211: add function for 802.3 conversion with separate output buffer")
+Reported-by: Chad Monroe <chad.monroe@smartrg.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -557,7 +557,7 @@ int ieee80211_data_to_8023_exthdr(struct
+ return -1;
+
+ hdrlen = ieee80211_hdrlen(hdr->frame_control) + data_offset;
+- if (skb->len < hdrlen + 8)
++ if (skb->len < hdrlen)
+ return -1;
+
+ /* convert IEEE 802.11 header + possible LLC headers into Ethernet
+@@ -572,8 +572,9 @@ int ieee80211_data_to_8023_exthdr(struct
+ memcpy(tmp.h_dest, ieee80211_get_DA(hdr), ETH_ALEN);
+ memcpy(tmp.h_source, ieee80211_get_SA(hdr), ETH_ALEN);
+
+- if (iftype == NL80211_IFTYPE_MESH_POINT)
+- skb_copy_bits(skb, hdrlen, &mesh_flags, 1);
++ if (iftype == NL80211_IFTYPE_MESH_POINT &&
++ skb_copy_bits(skb, hdrlen, &mesh_flags, 1) < 0)
++ return -1;
+
+ mesh_flags &= MESH_FLAGS_AE;
+
+@@ -593,11 +594,12 @@ int ieee80211_data_to_8023_exthdr(struct
+ if (iftype == NL80211_IFTYPE_MESH_POINT) {
+ if (mesh_flags == MESH_FLAGS_AE_A4)
+ return -1;
+- if (mesh_flags == MESH_FLAGS_AE_A5_A6) {
+- skb_copy_bits(skb, hdrlen +
+- offsetof(struct ieee80211s_hdr, eaddr1),
+- tmp.h_dest, 2 * ETH_ALEN);
+- }
++ if (mesh_flags == MESH_FLAGS_AE_A5_A6 &&
++ skb_copy_bits(skb, hdrlen +
++ offsetof(struct ieee80211s_hdr, eaddr1),
++ tmp.h_dest, 2 * ETH_ALEN) < 0)
++ return -1;
++
+ hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
+ }
+ break;
+@@ -611,10 +613,11 @@ int ieee80211_data_to_8023_exthdr(struct
+ if (iftype == NL80211_IFTYPE_MESH_POINT) {
+ if (mesh_flags == MESH_FLAGS_AE_A5_A6)
+ return -1;
+- if (mesh_flags == MESH_FLAGS_AE_A4)
+- skb_copy_bits(skb, hdrlen +
+- offsetof(struct ieee80211s_hdr, eaddr1),
+- tmp.h_source, ETH_ALEN);
++ if (mesh_flags == MESH_FLAGS_AE_A4 &&
++ skb_copy_bits(skb, hdrlen +
++ offsetof(struct ieee80211s_hdr, eaddr1),
++ tmp.h_source, ETH_ALEN) < 0)
++ return -1;
+ hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
+ }
+ break;
+@@ -626,18 +629,18 @@ int ieee80211_data_to_8023_exthdr(struct
+ break;
+ }
+
+- skb_copy_bits(skb, hdrlen, &payload, sizeof(payload));
+- tmp.h_proto = payload.proto;
+-
+- if (likely((!is_amsdu && ether_addr_equal(payload.hdr, rfc1042_header) &&
+- tmp.h_proto != htons(ETH_P_AARP) &&
+- tmp.h_proto != htons(ETH_P_IPX)) ||
+- ether_addr_equal(payload.hdr, bridge_tunnel_header)))
++ if (likely(skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
++ ((!is_amsdu && ether_addr_equal(payload.hdr, rfc1042_header) &&
++ payload.proto != htons(ETH_P_AARP) &&
++ payload.proto != htons(ETH_P_IPX)) ||
++ ether_addr_equal(payload.hdr, bridge_tunnel_header)))) {
+ /* remove RFC1042 or Bridge-Tunnel encapsulation and
+ * replace EtherType */
+ hdrlen += ETH_ALEN + 2;
+- else
++ tmp.h_proto = payload.proto;
++ } else {
+ tmp.h_proto = htons(skb->len - hdrlen);
++ }
+
+ pskb_pull(skb, hdrlen);
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/345-v6.1-wifi-mac80211-do-not-drop-packets-smaller-than-the-L.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/345-v6.1-wifi-mac80211-do-not-drop-packets-smaller-than-the-L.patch
new file mode 100644
index 0000000..23047f6
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/345-v6.1-wifi-mac80211-do-not-drop-packets-smaller-than-the-L.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Oct 2022 10:58:26 +0200
+Subject: [PATCH] wifi: mac80211: do not drop packets smaller than the
+ LLC-SNAP header on fast-rx
+
+Since STP TCN frames are only 7 bytes, the pskb_may_pull call returns an error.
+Instead of dropping those packets, bump them back to the slow path for proper
+processing.
+
+Fixes: 49ddf8e6e234 ("mac80211: add fast-rx path")
+Reported-by: Chad Monroe <chad.monroe@smartrg.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4603,7 +4603,7 @@ static bool ieee80211_invoke_fast_rx(str
+
+ if (!(status->rx_flags & IEEE80211_RX_AMSDU)) {
+ if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
+- goto drop;
++ return false;
+
+ payload = (void *)(skb->data + snap_offs);
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/346-v6.0-wifi-mac80211-fix-mesh-airtime-link-metric-estimatin.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/346-v6.0-wifi-mac80211-fix-mesh-airtime-link-metric-estimatin.patch
new file mode 100644
index 0000000..7185a7f
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/346-v6.0-wifi-mac80211-fix-mesh-airtime-link-metric-estimatin.patch
@@ -0,0 +1,36 @@
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Date: Fri, 1 Jul 2022 19:06:11 +0530
+Subject: [PATCH] wifi: mac80211: fix mesh airtime link metric estimating
+
+ieee80211s_update_metric function uses sta_set_rate_info_tx
+function to get struct rate_info data from ieee80211_tx_rate
+struct, present in ieee80211_sta->deflink.tx_stats. However,
+drivers can skip tx rate calculation by setting rate idx as
+-1. Such drivers provides rate_info directly and hence
+ieee80211s metric is updated incorrectly since ieee80211_tx_rate
+has inconsistent data.
+
+Add fix to use rate_info directly if present instead of
+sta_set_rate_info_tx for updating ieee80211s metric.
+
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Link: https://lore.kernel.org/r/20220701133611.544-1-quic_adisi@quicinc.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -310,7 +310,12 @@ void ieee80211s_update_metric(struct iee
+ LINK_FAIL_THRESH)
+ mesh_plink_broken(sta);
+
+- sta_set_rate_info_tx(sta, &sta->tx_stats.last_rate, &rinfo);
++ /* use rate info set by the driver directly if present */
++ if (st->rate)
++ rinfo = sta->tx_stats.last_rate_info;
++ else
++ sta_set_rate_info_tx(sta, &sta->tx_stats.last_rate, &rinfo);
++
+ ewma_mesh_tx_rate_avg_add(&sta->mesh->tx_rate_avg,
+ cfg80211_calculate_bitrate(&rinfo));
+ }
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/363-v5.19-bss-color-collision.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/363-v5.19-bss-color-collision.patch
new file mode 100644
index 0000000..edee4b3
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/363-v5.19-bss-color-collision.patch
@@ -0,0 +1,118 @@
+From 6d945a33f2b0aa24fc210dadaa0af3e8218e7002 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 25 Mar 2022 11:42:41 +0100
+Subject: [PATCH] mac80211: introduce BSS color collision detection
+
+Add ieee80211_rx_check_bss_color_collision routine in order to introduce
+BSS color collision detection in mac80211 if it is not supported in HW/FW
+(e.g. for mt7915 chipset).
+Add IEEE80211_HW_DETECTS_COLOR_COLLISION flag to let the driver notify
+BSS color collision detection is supported in HW/FW. Set this for ath11k
+which apparently didn't need this code.
+
+Tested-by: Peter Chiu <Chui-Hao.Chiu@mediatek.com>
+Co-developed-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/a05eeeb1841a84560dc5aaec77894fcb69a54f27.1648204871.git.lorenzo@kernel.org
+[clarify commit message a bit, move flag to mac80211]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 5 ++-
+ include/net/mac80211.h | 4 +++
+ net/mac80211/debugfs.c | 1 +
+ net/mac80211/rx.c | 46 +++++++++++++++++++++++++++
+ 4 files changed, 55 insertions(+), 1 deletion(-)
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -2418,6 +2418,9 @@ struct ieee80211_txq {
+ * usage and 802.11 frames with %RX_FLAG_ONLY_MONITOR set for monitor to
+ * the stack.
+ *
++ * @IEEE80211_HW_DETECTS_COLOR_COLLISION: HW/driver has support for BSS color
++ * collision detection and doesn't need it in software.
++ *
+ * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
+ */
+ enum ieee80211_hw_flags {
+@@ -2473,6 +2476,7 @@ enum ieee80211_hw_flags {
+ IEEE80211_HW_SUPPORTS_TX_ENCAP_OFFLOAD,
+ IEEE80211_HW_SUPPORTS_RX_DECAP_OFFLOAD,
+ IEEE80211_HW_SUPPORTS_CONC_MON_RX_DECAP,
++ IEEE80211_HW_DETECTS_COLOR_COLLISION,
+
+ /* keep last, obviously */
+ NUM_IEEE80211_HW_FLAGS
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -494,6 +494,7 @@ static const char *hw_flag_names[] = {
+ FLAG(SUPPORTS_TX_ENCAP_OFFLOAD),
+ FLAG(SUPPORTS_RX_DECAP_OFFLOAD),
+ FLAG(SUPPORTS_CONC_MON_RX_DECAP),
++ FLAG(DETECTS_COLOR_COLLISION),
+ #undef FLAG
+ };
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3182,6 +3182,49 @@ static void ieee80211_process_sa_query_r
+ ieee80211_tx_skb(sdata, skb);
+ }
+
++static void
++ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
++{
++ struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
++ const struct element *ie;
++ size_t baselen;
++
++ if (!wiphy_ext_feature_isset(rx->local->hw.wiphy,
++ NL80211_EXT_FEATURE_BSS_COLOR))
++ return;
++
++ if (ieee80211_hw_check(&rx->local->hw, DETECTS_COLOR_COLLISION))
++ return;
++
++ if (rx->sdata->vif.csa_active)
++ return;
++
++ baselen = mgmt->u.beacon.variable - rx->skb->data;
++ if (baselen > rx->skb->len)
++ return;
++
++ ie = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION,
++ mgmt->u.beacon.variable,
++ rx->skb->len - baselen);
++ if (ie && ie->datalen >= sizeof(struct ieee80211_he_operation) &&
++ ie->datalen >= ieee80211_he_oper_size(ie->data + 1)) {
++ struct ieee80211_bss_conf *bss_conf = &rx->sdata->vif.bss_conf;
++ const struct ieee80211_he_operation *he_oper;
++ u8 color;
++
++ he_oper = (void *)(ie->data + 1);
++ if (le32_get_bits(he_oper->he_oper_params,
++ IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED))
++ return;
++
++ color = le32_get_bits(he_oper->he_oper_params,
++ IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
++ if (color == bss_conf->he_bss_color.color)
++ ieeee80211_obss_color_collision_notify(&rx->sdata->vif,
++ BIT_ULL(color));
++ }
++}
++
+ static ieee80211_rx_result debug_noinline
+ ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
+ {
+@@ -3207,6 +3250,9 @@ ieee80211_rx_h_mgmt_check(struct ieee802
+ !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
+ int sig = 0;
+
++ /* sw bss color collision detection */
++ ieee80211_rx_check_bss_color_collision(rx);
++
+ if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
+ !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
+ sig = status->signal;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/364-mac80211-add-support-for-restricting-netdev-features.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/364-mac80211-add-support-for-restricting-netdev-features.patch
new file mode 100644
index 0000000..d133ed9
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/364-mac80211-add-support-for-restricting-netdev-features.patch
@@ -0,0 +1,513 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 9 Oct 2022 20:15:46 +0200
+Subject: [PATCH] mac80211: add support for restricting netdev features per vif
+
+This can be used to selectively disable feature flags for checksum offload,
+scatter/gather or GSO by changing vif->netdev_features.
+Removing features from vif->netdev_features does not affect the netdev
+features themselves, but instead fixes up skbs in the tx path so that the
+offloads are not needed in the driver.
+
+Aside from making it easier to deal with vif type based hardware limitations,
+this also makes it possible to optimize performance on hardware without native
+GSO support by declaring GSO support in hw->netdev_features and removing it
+from vif->netdev_features. This allows mac80211 to handle GSO segmentation
+after the sta lookup, but before itxq enqueue, thus reducing the number of
+unnecessary sta lookups, as well as some other per-packet processing.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/fq_impl.h
++++ b/include/net/fq_impl.h
+@@ -200,6 +200,7 @@ static void fq_tin_enqueue(struct fq *fq
+ fq_skb_free_t free_func)
+ {
+ struct fq_flow *flow;
++ struct sk_buff *next;
+ bool oom;
+
+ lockdep_assert_held(&fq->lock);
+@@ -214,11 +215,15 @@ static void fq_tin_enqueue(struct fq *fq
+ }
+
+ flow->tin = tin;
+- flow->backlog += skb->len;
+- tin->backlog_bytes += skb->len;
+- tin->backlog_packets++;
+- fq->memory_usage += skb->truesize;
+- fq->backlog++;
++ skb_list_walk_safe(skb, skb, next) {
++ skb_mark_not_on_list(skb);
++ flow->backlog += skb->len;
++ tin->backlog_bytes += skb->len;
++ tin->backlog_packets++;
++ fq->memory_usage += skb->truesize;
++ fq->backlog++;
++ __skb_queue_tail(&flow->queue, skb);
++ }
+
+ if (list_empty(&flow->flowchain)) {
+ flow->deficit = fq->quantum;
+@@ -226,7 +231,6 @@ static void fq_tin_enqueue(struct fq *fq
+ &tin->new_flows);
+ }
+
+- __skb_queue_tail(&flow->queue, skb);
+ oom = (fq->memory_usage > fq->memory_limit);
+ while (fq->backlog > fq->limit || oom) {
+ flow = fq_find_fattest_flow(fq);
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1685,6 +1685,10 @@ enum ieee80211_offload_flags {
+ * write-protected by sdata_lock and local->mtx so holding either is fine
+ * for read access.
+ * @mu_mimo_owner: indicates interface owns MU-MIMO capability
++ * @netdev_features: tx netdev features supported by the hardware for this
++ * vif. mac80211 initializes this to hw->netdev_features, and the driver
++ * can mask out specific tx features. mac80211 will handle software fixup
++ * for masked offloads (GSO, CSUM)
+ * @driver_flags: flags/capabilities the driver has for this interface,
+ * these need to be set (or cleared) when the interface is added
+ * or, if supported by the driver, the interface type is changed
+@@ -1736,6 +1740,7 @@ struct ieee80211_vif {
+
+ struct ieee80211_chanctx_conf __rcu *chanctx_conf;
+
++ netdev_features_t netdev_features;
+ u32 driver_flags;
+ u32 offload_flags;
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -2209,6 +2209,7 @@ int ieee80211_if_add(struct ieee80211_lo
+ ndev->features |= local->hw.netdev_features;
+ ndev->hw_features |= ndev->features &
+ MAC80211_SUPPORTED_FEATURES_TX;
++ sdata->vif.netdev_features = local->hw.netdev_features;
+
+ netdev_set_default_ethtool_ops(ndev, &ieee80211_ethtool_ops);
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1310,7 +1310,11 @@ static struct txq_info *ieee80211_get_tx
+
+ static void ieee80211_set_skb_enqueue_time(struct sk_buff *skb)
+ {
+- IEEE80211_SKB_CB(skb)->control.enqueue_time = codel_get_time();
++ struct sk_buff *next;
++ codel_time_t now = codel_get_time();
++
++ skb_list_walk_safe(skb, skb, next)
++ IEEE80211_SKB_CB(skb)->control.enqueue_time = now;
+ }
+
+ static u32 codel_skb_len_func(const struct sk_buff *skb)
+@@ -3499,47 +3503,71 @@ ieee80211_xmit_fast_finish(struct ieee80
+ return TX_CONTINUE;
+ }
+
+-static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
+- struct sta_info *sta,
+- struct ieee80211_fast_tx *fast_tx,
+- struct sk_buff *skb)
++static netdev_features_t
++ieee80211_sdata_netdev_features(struct ieee80211_sub_if_data *sdata)
+ {
+- struct ieee80211_local *local = sdata->local;
+- u16 ethertype = (skb->data[12] << 8) | skb->data[13];
+- int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
+- int hw_headroom = sdata->local->hw.extra_tx_headroom;
+- struct ethhdr eth;
+- struct ieee80211_tx_info *info;
+- struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
+- struct ieee80211_tx_data tx;
+- ieee80211_tx_result r;
+- struct tid_ampdu_tx *tid_tx = NULL;
+- u8 tid = IEEE80211_NUM_TIDS;
++ if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
++ return sdata->vif.netdev_features;
+
+- /* control port protocol needs a lot of special handling */
+- if (cpu_to_be16(ethertype) == sdata->control_port_protocol)
+- return false;
++ if (!sdata->bss)
++ return 0;
+
+- /* only RFC 1042 SNAP */
+- if (ethertype < ETH_P_802_3_MIN)
+- return false;
++ sdata = container_of(sdata->bss, struct ieee80211_sub_if_data, u.ap);
++ return sdata->vif.netdev_features;
++}
+
+- /* don't handle TX status request here either */
+- if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
+- return false;
++static struct sk_buff *
++ieee80211_tx_skb_fixup(struct sk_buff *skb, netdev_features_t features)
++{
++ if (skb_is_gso(skb)) {
++ struct sk_buff *segs;
+
+- if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
+- tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
+- tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
+- if (tid_tx) {
+- if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
+- return false;
+- if (tid_tx->timeout)
+- tid_tx->last_tx = jiffies;
+- }
++ segs = skb_gso_segment(skb, features);
++ if (!segs)
++ return skb;
++ if (IS_ERR(segs))
++ goto free;
++
++ consume_skb(skb);
++ return segs;
++ }
++
++ if (skb_needs_linearize(skb, features) && __skb_linearize(skb))
++ goto free;
++
++ if (skb->ip_summed == CHECKSUM_PARTIAL) {
++ int ofs = skb_checksum_start_offset(skb);
++
++ if (skb->encapsulation)
++ skb_set_inner_transport_header(skb, ofs);
++ else
++ skb_set_transport_header(skb, ofs);
++
++ if (skb_csum_hwoffload_help(skb, features))
++ goto free;
+ }
+
+- /* after this point (skb is modified) we cannot return false */
++ skb_mark_not_on_list(skb);
++ return skb;
++
++free:
++ kfree_skb(skb);
++ return NULL;
++}
++
++static void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
++ struct sta_info *sta,
++ struct ieee80211_fast_tx *fast_tx,
++ struct sk_buff *skb, u8 tid, bool ampdu)
++{
++ struct ieee80211_local *local = sdata->local;
++ struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
++ struct ieee80211_tx_info *info;
++ struct ieee80211_tx_data tx;
++ ieee80211_tx_result r;
++ int hw_headroom = sdata->local->hw.extra_tx_headroom;
++ int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
++ struct ethhdr eth;
+
+ if (skb_shared(skb)) {
+ struct sk_buff *tmp_skb = skb;
+@@ -3548,12 +3576,12 @@ static bool ieee80211_xmit_fast(struct i
+ kfree_skb(tmp_skb);
+
+ if (!skb)
+- return true;
++ return;
+ }
+
+ if ((hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) &&
+ ieee80211_amsdu_aggregate(sdata, sta, fast_tx, skb))
+- return true;
++ return;
+
+ /* will not be crypto-handled beyond what we do here, so use false
+ * as the may-encrypt argument for the resize to not account for
+@@ -3562,10 +3590,8 @@ static bool ieee80211_xmit_fast(struct i
+ if (unlikely(ieee80211_skb_resize(sdata, skb,
+ max_t(int, extra_head + hw_headroom -
+ skb_headroom(skb), 0),
+- ENCRYPT_NO))) {
+- kfree_skb(skb);
+- return true;
+- }
++ ENCRYPT_NO)))
++ goto free;
+
+ memcpy(ð, skb->data, ETH_HLEN - 2);
+ hdr = skb_push(skb, extra_head);
+@@ -3579,7 +3605,7 @@ static bool ieee80211_xmit_fast(struct i
+ info->control.vif = &sdata->vif;
+ info->flags = IEEE80211_TX_CTL_FIRST_FRAGMENT |
+ IEEE80211_TX_CTL_DONTFRAG |
+- (tid_tx ? IEEE80211_TX_CTL_AMPDU : 0);
++ (ampdu ? IEEE80211_TX_CTL_AMPDU : 0);
+ info->control.flags = IEEE80211_TX_CTRL_FAST_XMIT;
+
+ #ifdef CPTCFG_MAC80211_DEBUGFS
+@@ -3601,16 +3627,14 @@ static bool ieee80211_xmit_fast(struct i
+ tx.key = fast_tx->key;
+
+ if (ieee80211_queue_skb(local, sdata, sta, skb))
+- return true;
++ return;
+
+ tx.skb = skb;
+ r = ieee80211_xmit_fast_finish(sdata, sta, fast_tx->pn_offs,
+ fast_tx->key, &tx);
+ tx.skb = NULL;
+- if (r == TX_DROP) {
+- kfree_skb(skb);
+- return true;
+- }
++ if (r == TX_DROP)
++ goto free;
+
+ if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+ sdata = container_of(sdata->bss,
+@@ -3618,6 +3642,55 @@ static bool ieee80211_xmit_fast(struct i
+
+ __skb_queue_tail(&tx.skbs, skb);
+ ieee80211_tx_frags(local, &sdata->vif, sta, &tx.skbs, false);
++ return;
++
++free:
++ kfree_skb(skb);
++}
++
++static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
++ struct sta_info *sta,
++ struct ieee80211_fast_tx *fast_tx,
++ struct sk_buff *skb)
++{
++ u16 ethertype = (skb->data[12] << 8) | skb->data[13];
++ struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
++ struct tid_ampdu_tx *tid_tx = NULL;
++ struct sk_buff *next;
++ u8 tid = IEEE80211_NUM_TIDS;
++
++ /* control port protocol needs a lot of special handling */
++ if (cpu_to_be16(ethertype) == sdata->control_port_protocol)
++ return false;
++
++ /* only RFC 1042 SNAP */
++ if (ethertype < ETH_P_802_3_MIN)
++ return false;
++
++ /* don't handle TX status request here either */
++ if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
++ return false;
++
++ if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
++ tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++ tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
++ if (tid_tx) {
++ if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
++ return false;
++ if (tid_tx->timeout)
++ tid_tx->last_tx = jiffies;
++ }
++ }
++
++ skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
++ if (!skb)
++ return true;
++
++ skb_list_walk_safe(skb, skb, next) {
++ skb_mark_not_on_list(skb);
++ __ieee80211_xmit_fast(sdata, sta, fast_tx, skb, tid, tid_tx);
++ }
++
+ return true;
+ }
+
+@@ -4123,31 +4196,14 @@ void __ieee80211_subif_start_xmit(struct
+ goto out;
+ }
+
+- if (skb_is_gso(skb)) {
+- struct sk_buff *segs;
+-
+- segs = skb_gso_segment(skb, 0);
+- if (IS_ERR(segs)) {
+- goto out_free;
+- } else if (segs) {
+- consume_skb(skb);
+- skb = segs;
+- }
+- } else {
+- /* we cannot process non-linear frames on this path */
+- if (skb_linearize(skb))
+- goto out_free;
+-
+- /* the frame could be fragmented, software-encrypted, and other
+- * things so we cannot really handle checksum offload with it -
+- * fix it up in software before we handle anything else.
+- */
+- if (skb->ip_summed == CHECKSUM_PARTIAL) {
+- skb_set_transport_header(skb,
+- skb_checksum_start_offset(skb));
+- if (skb_checksum_help(skb))
+- goto out_free;
+- }
++ /* the frame could be fragmented, software-encrypted, and other
++ * things so we cannot really handle checksum or GSO offload.
++ * fix it up in software before we handle anything else.
++ */
++ skb = ieee80211_tx_skb_fixup(skb, 0);
++ if (!skb) {
++ len = 0;
++ goto out;
+ }
+
+ skb_list_walk_safe(skb, skb, next) {
+@@ -4310,9 +4366,11 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+ return NETDEV_TX_OK;
+ }
+
+-static bool ieee80211_tx_8023(struct ieee80211_sub_if_data *sdata,
+- struct sk_buff *skb, struct sta_info *sta,
+- bool txpending)
++
++
++static bool __ieee80211_tx_8023(struct ieee80211_sub_if_data *sdata,
++ struct sk_buff *skb, struct sta_info *sta,
++ bool txpending)
+ {
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_tx_control control = {};
+@@ -4321,14 +4379,6 @@ static bool ieee80211_tx_8023(struct iee
+ unsigned long flags;
+ int q = info->hw_queue;
+
+- if (sta)
+- sk_pacing_shift_update(skb->sk, local->hw.tx_sk_pacing_shift);
+-
+- ieee80211_tpt_led_trig_tx(local, skb->len);
+-
+- if (ieee80211_queue_skb(local, sdata, sta, skb))
+- return true;
+-
+ spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+
+ if (local->queue_stop_reasons[q] ||
+@@ -4355,27 +4405,50 @@ static bool ieee80211_tx_8023(struct iee
+ return true;
+ }
+
++static bool ieee80211_tx_8023(struct ieee80211_sub_if_data *sdata,
++ struct sk_buff *skb, struct sta_info *sta,
++ bool txpending)
++{
++ struct ieee80211_local *local = sdata->local;
++ struct sk_buff *next;
++ bool ret = true;
++
++ if (ieee80211_queue_skb(local, sdata, sta, skb))
++ return true;
++
++ skb_list_walk_safe(skb, skb, next) {
++ skb_mark_not_on_list(skb);
++ if (!__ieee80211_tx_8023(sdata, skb, sta, txpending))
++ ret = false;
++ }
++
++ return ret;
++}
++
+ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
+ struct net_device *dev, struct sta_info *sta,
+ struct ieee80211_key *key, struct sk_buff *skb)
+ {
+- struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++ struct ieee80211_tx_info *info;
+ struct ieee80211_local *local = sdata->local;
+ struct tid_ampdu_tx *tid_tx;
++ struct sk_buff *seg, *next;
++ unsigned int skbs = 0, len = 0;
++ u16 queue;
+ u8 tid;
+
+ if (local->ops->wake_tx_queue) {
+- u16 queue = __ieee80211_select_queue(sdata, sta, skb);
++ queue = __ieee80211_select_queue(sdata, sta, skb);
+ skb_set_queue_mapping(skb, queue);
+ skb_get_hash(skb);
++ } else {
++ queue = skb_get_queue_mapping(skb);
+ }
+
+ if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)) &&
+ test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
+ goto out_free;
+
+- memset(info, 0, sizeof(*info));
+-
+ ieee80211_aggr_check(sdata, sta, skb);
+
+ tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
+@@ -4387,22 +4460,20 @@ static void ieee80211_8023_xmit(struct i
+ return;
+ }
+
+- info->flags |= IEEE80211_TX_CTL_AMPDU;
+ if (tid_tx->timeout)
+ tid_tx->last_tx = jiffies;
+ }
+
+- if (unlikely(skb->sk &&
+- skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS))
+- info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
+- &info->flags, NULL);
++ skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
++ if (!skb)
++ return;
+
+- info->hw_queue = sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
++ info = IEEE80211_SKB_CB(skb);
++ memset(info, 0, sizeof(*info));
++ if (tid_tx)
++ info->flags |= IEEE80211_TX_CTL_AMPDU;
+
+- dev_sw_netstats_tx_add(dev, 1, skb->len);
+-
+- sta->tx_stats.bytes[skb_get_queue_mapping(skb)] += skb->len;
+- sta->tx_stats.packets[skb_get_queue_mapping(skb)]++;
++ info->hw_queue = sdata->vif.hw_queue[queue];
+
+ if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+ sdata = container_of(sdata->bss,
+@@ -4414,6 +4485,24 @@ static void ieee80211_8023_xmit(struct i
+ if (key)
+ info->control.hw_key = &key->conf;
+
++ skb_list_walk_safe(skb, seg, next) {
++ skbs++;
++ len += seg->len;
++ if (seg != skb)
++ memcpy(IEEE80211_SKB_CB(seg), info, sizeof(*info));
++ }
++
++ if (unlikely(skb->sk &&
++ skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS))
++ info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
++ &info->flags, NULL);
++
++ dev_sw_netstats_tx_add(dev, skbs, len);
++ sta->tx_stats.packets[queue] += skbs;
++ sta->tx_stats.bytes[queue] += len;
++
++ ieee80211_tpt_led_trig_tx(local, len);
++
+ ieee80211_tx_8023(sdata, skb, sta, false);
+
+ return;
+@@ -4455,6 +4544,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+ key->conf.cipher == WLAN_CIPHER_SUITE_TKIP))
+ goto skip_offload;
+
++ sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
+ ieee80211_8023_xmit(sdata, dev, sta, key, skb);
+ goto out;
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/400-allow-ibss-mixed.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/400-allow-ibss-mixed.patch
new file mode 100644
index 0000000..f0f850d
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/400-allow-ibss-mixed.patch
@@ -0,0 +1,40 @@
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Mon, 24 Feb 2020 00:00:00 +0100
+Subject: [PATCH] mac80211: Allow IBSS mode and different beacon intervals
+
+ath10k-ct supports the combination to select IBSS (ADHOC) mode and
+different beacon intervals together. mac80211 does not like this
+combination, but Ben says this is ok, so remove this check.
+
+ath10k-ct starting with version 5.2 allows the combination of
+NL80211_IFTYPE_ADHOC and beacon_int_min_gcd in ath10k_10x_ct_if_comb
+which triggers this warning. Ben told me that this is not a big problem
+and we should ignore this.
+---
+ net/wireless/core.c | 15 ---------------
+ 1 file changed, 15 deletions(-)
+
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -625,21 +625,6 @@ static int wiphy_verify_combinations(str
+ c->limits[j].max > 1))
+ return -EINVAL;
+
+- /*
+- * This isn't well-defined right now. If you have an
+- * IBSS interface, then its beacon interval may change
+- * by joining other networks, and nothing prevents it
+- * from doing that.
+- * So technically we probably shouldn't even allow AP
+- * and IBSS in the same interface, but it seems that
+- * some drivers support that, possibly only with fixed
+- * beacon intervals for IBSS.
+- */
+- if (WARN_ON(types & BIT(NL80211_IFTYPE_ADHOC) &&
+- c->beacon_int_min_gcd)) {
+- return -EINVAL;
+- }
+-
+ cnt += c->limits[j].max;
+ /*
+ * Don't advertise an unsupported type
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
new file mode 100644
index 0000000..962ae93
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
@@ -0,0 +1,162 @@
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -3869,6 +3869,7 @@ struct mgmt_frame_regs {
+ * (as advertised by the nl80211 feature flag.)
+ * @get_tx_power: store the current TX power into the dbm variable;
+ * return 0 if successful
++ * @set_antenna_gain: set antenna gain to reduce maximum tx power if necessary
+ *
+ * @rfkill_poll: polls the hw rfkill line, use cfg80211 reporting
+ * functions to adjust rfkill hw state
+@@ -4202,6 +4203,7 @@ struct cfg80211_ops {
+ enum nl80211_tx_power_setting type, int mbm);
+ int (*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
+ int *dbm);
++ int (*set_antenna_gain)(struct wiphy *wiphy, int dbi);
+
+ void (*rfkill_poll)(struct wiphy *wiphy);
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1566,6 +1566,7 @@ enum ieee80211_smps_mode {
+ *
+ * @power_level: requested transmit power (in dBm), backward compatibility
+ * value only that is set to the minimum of all interfaces
++ * @max_antenna_gain: maximum antenna gain adjusted by user config (in dBi)
+ *
+ * @chandef: the channel definition to tune to
+ * @radar_enabled: whether radar detection is enabled
+@@ -1586,6 +1587,7 @@ enum ieee80211_smps_mode {
+ struct ieee80211_conf {
+ u32 flags;
+ int power_level, dynamic_ps_timeout;
++ int max_antenna_gain;
+
+ u16 listen_interval;
+ u8 ps_dtim_period;
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2615,6 +2615,9 @@ enum nl80211_commands {
+ * switching on a different channel during CAC detection on the selected
+ * radar channel.
+ *
++ * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
++ * transmit power to stay within regulatory limits. u32, dBi.
++ *
+ * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+ * @NL80211_ATTR_MAX: highest attribute number currently defined
+ * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3123,6 +3126,8 @@ enum nl80211_attrs {
+
+ NL80211_ATTR_RADAR_BACKGROUND,
+
++ NL80211_ATTR_WIPHY_ANTENNA_GAIN,
++
+ /* add attributes here, update the policy in nl80211.c */
+
+ __NL80211_ATTR_AFTER_LAST,
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2812,6 +2812,19 @@ static int ieee80211_get_tx_power(struct
+ return 0;
+ }
+
++static int ieee80211_set_antenna_gain(struct wiphy *wiphy, int dbi)
++{
++ struct ieee80211_local *local = wiphy_priv(wiphy);
++
++ if (dbi < 0)
++ return -EINVAL;
++
++ local->user_antenna_gain = dbi;
++ ieee80211_hw_config(local, 0);
++
++ return 0;
++}
++
+ static void ieee80211_rfkill_poll(struct wiphy *wiphy)
+ {
+ struct ieee80211_local *local = wiphy_priv(wiphy);
+@@ -4513,6 +4526,7 @@ const struct cfg80211_ops mac80211_confi
+ .set_wiphy_params = ieee80211_set_wiphy_params,
+ .set_tx_power = ieee80211_set_tx_power,
+ .get_tx_power = ieee80211_get_tx_power,
++ .set_antenna_gain = ieee80211_set_antenna_gain,
+ .rfkill_poll = ieee80211_rfkill_poll,
+ CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
+ CFG80211_TESTMODE_DUMP(ieee80211_testmode_dump)
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1447,6 +1447,7 @@ struct ieee80211_local {
+ int dynamic_ps_forced_timeout;
+
+ int user_power_level; /* in dBm, for all interfaces */
++ int user_antenna_gain; /* in dBi */
+
+ enum ieee80211_smps_mode smps_mode;
+
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -96,7 +96,7 @@ static u32 ieee80211_hw_conf_chan(struct
+ struct ieee80211_sub_if_data *sdata;
+ struct cfg80211_chan_def chandef = {};
+ u32 changed = 0;
+- int power;
++ int power, max_power;
+ u32 offchannel_flag;
+
+ offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
+@@ -157,6 +157,12 @@ static u32 ieee80211_hw_conf_chan(struct
+ }
+ rcu_read_unlock();
+
++ max_power = chandef.chan->max_reg_power;
++ if (local->user_antenna_gain > 0) {
++ max_power -= local->user_antenna_gain;
++ power = min(power, max_power);
++ }
++
+ if (local->hw.conf.power_level != power) {
+ changed |= IEEE80211_CONF_CHANGE_POWER;
+ local->hw.conf.power_level = power;
+@@ -679,6 +685,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ IEEE80211_RADIOTAP_MCS_HAVE_BW;
+ local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
+ IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
++ local->user_antenna_gain = 0;
+ local->hw.uapsd_queues = IEEE80211_DEFAULT_UAPSD_QUEUES;
+ local->hw.uapsd_max_sp_len = IEEE80211_DEFAULT_MAX_SP_LEN;
+ local->hw.max_mtu = IEEE80211_MAX_DATA_LEN;
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -802,6 +802,7 @@ static const struct nla_policy nl80211_p
+ NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
+ [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
+ [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
++ [NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
+ };
+
+ /* policy for the key attributes */
+@@ -3391,6 +3392,22 @@ static int nl80211_set_wiphy(struct sk_b
+ if (result)
+ goto out;
+ }
++
++ if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_GAIN]) {
++ int idx, dbi = 0;
++
++ if (!rdev->ops->set_antenna_gain) {
++ result = -EOPNOTSUPP;
++ goto out;
++ }
++
++ idx = NL80211_ATTR_WIPHY_ANTENNA_GAIN;
++ dbi = nla_get_u32(info->attrs[idx]);
++
++ result = rdev->ops->set_antenna_gain(&rdev->wiphy, dbi);
++ if (result)
++ goto out;
++ }
+
+ if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
+ struct wireless_dev *txp_wdev = wdev;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch
new file mode 100644
index 0000000..26af6a2
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch
@@ -0,0 +1,29 @@
+--- a/backport-include/linux/of_net.h
++++ /dev/null
+@@ -1,26 +0,0 @@
+-#ifndef _BP_OF_NET_H
+-#define _BP_OF_NET_H
+-#include_next <linux/of_net.h>
+-#include <linux/version.h>
+-#include <linux/etherdevice.h>
+-
+-/* The behavior of of_get_mac_address() changed in kernel 5.2, it now
+- * returns an error code and not NULL in case of an error.
+- */
+-#if LINUX_VERSION_IS_LESS(5,13,0)
+-static inline int backport_of_get_mac_address(struct device_node *np, u8 *mac_out)
+-{
+- const void *mac = of_get_mac_address(np);
+-
+- if (!mac)
+- return -ENODEV;
+- if (IS_ERR(mac))
+- return PTR_ERR(mac);
+- ether_addr_copy(mac_out, mac);
+-
+- return 0;
+-}
+-#define of_get_mac_address LINUX_BACKPORT(of_get_mac_address)
+-#endif /* < 5.2 */
+-
+-#endif /* _BP_OF_NET_H */
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/783-sync-nl80211.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/783-sync-nl80211.patch
new file mode 100644
index 0000000..dc2b05b
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/783-sync-nl80211.patch
@@ -0,0 +1,22 @@
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -6027,6 +6027,11 @@ enum nl80211_feature_flags {
+ * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
+ * detection and change announcemnts.
+ *
++ * @NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD: Driver running in AP mode supports
++ * FILS encryption and decryption for (Re)Association Request and Response
++ * frames. Userspace has to share FILS AAD details to the driver by using
++ * @NL80211_CMD_SET_FILS_AAD.
++ *
+ * @NL80211_EXT_FEATURE_RADAR_BACKGROUND: Device supports background radar/CAC
+ * detection.
+ *
+@@ -6095,6 +6100,7 @@ enum nl80211_ext_feature_index {
+ NL80211_EXT_FEATURE_SECURE_RTT,
+ NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
+ NL80211_EXT_FEATURE_BSS_COLOR,
++ NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD,
+ NL80211_EXT_FEATURE_RADAR_BACKGROUND,
+
+ /* add new features before the definition below */
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch
new file mode 100644
index 0000000..a17d6f6
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch
@@ -0,0 +1,33 @@
+From 313d8c18385f10957402b475f9b0c209ceab6c5a Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 8 Oct 2021 00:25:19 +0200
+Subject: [PATCH] mac80211: mask nested A-MSDU support for mesh
+
+mac80211 incorrectly processes A-MSDUs contained in A-MPDU frames. This
+results in dropped packets and severely impacted throughput.
+
+As a workaround, don't indicate support for A-MSDUs contained in
+A-MPDUs. This improves throughput over mesh links by factor 10.
+
+Ref: https://github.com/openwrt/mt76/issues/450
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ net/mac80211/agg-rx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -251,7 +251,11 @@ static void ieee80211_send_addba_resp(st
+ mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
+ mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
+
+- capab = u16_encode_bits(amsdu, IEEE80211_ADDBA_PARAM_AMSDU_MASK);
++ capab = 0;
++#ifdef CPTCFG_MAC80211_MESH
++ if (!sta->mesh)
++#endif
++ capab = u16_encode_bits(amsdu, IEEE80211_ADDBA_PARAM_AMSDU_MASK);
+ capab |= u16_encode_bits(policy, IEEE80211_ADDBA_PARAM_POLICY_MASK);
+ capab |= u16_encode_bits(tid, IEEE80211_ADDBA_PARAM_TID_MASK);
+ capab |= u16_encode_bits(buf_size, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
new file mode 100644
index 0000000..d26fe38
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
@@ -0,0 +1,27 @@
+From 78275901240835e58b0f883065061f90c7fba310 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Tue, 18 Jan 2022 20:29:44 +0800
+Subject: [PATCH 900/911] mac80211: mtk: do not setup twt when twt responder is
+ false
+
+---
+ net/mac80211/rx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index b991151..eb16838 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3283,6 +3283,9 @@ ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
+ if (sdata->vif.type != NL80211_IFTYPE_AP)
+ return false;
+
++ if (!sdata->vif.bss_conf.twt_responder)
++ return false;
++
+ if (!rx->local->ops->add_twt_setup)
+ return false;
+
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
new file mode 100644
index 0000000..6702727
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
@@ -0,0 +1,32 @@
+From fbe3cb1d42673c431f0f933620d0a1ec86a41113 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 29 Mar 2022 16:06:30 +0800
+Subject: [PATCH 901/911] nl80211: mtk: extend CAC time for weather radar
+ channels
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ net/wireless/nl80211.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index bc6b5ac..3c6c1df 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -9354,6 +9354,13 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
+ if (WARN_ON(!cac_time_ms))
+ cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+
++ if ((dfs_region == NL80211_DFS_ETSI) &&
++ (((chandef.width == NL80211_CHAN_WIDTH_160) &&
++ (chandef.center_freq2 >= 5580 && chandef.center_freq2 <= 5640)) ||
++ (chandef.center_freq1 >= 5580 && chandef.center_freq1 <= 5640)))
++ cac_time_ms = 600000;
++ pr_info("%s: region = %u, cetner freq1 = %u, center freq2 = %u, cac time ms = %u\n", __func__, dfs_region, chandef.center_freq1, chandef.center_freq2, cac_time_ms);
++
+ err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
+ if (!err) {
+ wdev->chandef = chandef;
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
new file mode 100644
index 0000000..da34346
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
@@ -0,0 +1,28 @@
+From 0bc1d2e42f5424d5f784d89a9e65cb9cac494269 Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Fri, 1 Apr 2022 09:15:21 +0800
+Subject: [PATCH 902/911] mac80211: mtk: it's invalid case when frag_threshold
+ is greater than 2346
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ net/wireless/nl80211.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 3c6c1df..1292634 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3495,6 +3495,9 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
+ goto out;
+ }
+
++ if (frag_threshold >= 2346)
++ frag_threshold = (u32) -1;
++
+ if (frag_threshold != (u32) -1) {
+ /*
+ * Fragments (apart from the last one) are required to
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/903-mac80211-mtk-correct-legacy-rates-check-in-ieee80211.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/903-mac80211-mtk-correct-legacy-rates-check-in-ieee80211.patch
new file mode 100644
index 0000000..d64a09b
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/903-mac80211-mtk-correct-legacy-rates-check-in-ieee80211.patch
@@ -0,0 +1,32 @@
+From 82549ae647667d825f49e67b8f21fa39db67ec13 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+Date: Mon, 7 Mar 2022 15:18:00 +0800
+Subject: [PATCH 903/911] mac80211: mtk: correct legacy rates check in
+ ieee80211_calc_rx_airtime
+
+There are no legacy rates on 60GHz or sub-1Ghz band, so modify the check.
+
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+---
+ net/mac80211/airtime.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/airtime.c b/net/mac80211/airtime.c
+index 26d2f8b..c0e58eb 100644
+--- a/net/mac80211/airtime.c
++++ b/net/mac80211/airtime.c
+@@ -477,7 +477,9 @@ u32 ieee80211_calc_rx_airtime(struct ieee80211_hw *hw,
+ bool sp = status->enc_flags & RX_ENC_FLAG_SHORTPRE;
+ bool cck;
+
+- if (WARN_ON_ONCE(status->band > NL80211_BAND_5GHZ))
++ /* on 60GHz or sub-1Ghz band, there are no legacy rates */
++ if (WARN_ON_ONCE(status->band == NL80211_BAND_60GHZ ||
++ status->band == NL80211_BAND_S1GHZ))
+ return 0;
+
+ sband = hw->wiphy->bands[status->band];
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/904-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/904-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
new file mode 100644
index 0000000..68976b2
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/904-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
@@ -0,0 +1,30 @@
+From 9a01b1fb748c13c9b3e6b670de80d9e41909f917 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Wed, 19 Oct 2022 13:42:43 +0800
+Subject: [PATCH 904/911] mac80211: mtk: airtime_flags depends on
+ NL80211_EXT_FEATURE
+
+Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+---
+ net/mac80211/main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 09e5bf1..8c005f1 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -721,8 +721,9 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
+ IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H;
+ atomic_set(&local->aql_ac_pending_airtime[i], 0);
+ }
+-
+- local->airtime_flags = AIRTIME_USE_TX | AIRTIME_USE_RX;
++ if (wiphy_ext_feature_isset(local->hw.wiphy,
++ NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
++ local->airtime_flags = AIRTIME_USE_TX | AIRTIME_USE_RX;
+ local->aql_threshold = IEEE80211_AQL_THRESHOLD;
+ atomic_set(&local->aql_total_pending_airtime, 0);
+
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/905-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/905-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
new file mode 100644
index 0000000..04614d9
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/905-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
@@ -0,0 +1,181 @@
+From 31e449f812b7ca3f4bdea98c63f2d98bc740a112 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Wed, 19 Oct 2022 13:45:42 +0800
+Subject: [PATCH 905/911] mac80211: mtk: add support for runtime set inband
+ discovery
+
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+---
+ include/net/cfg80211.h | 1 +
+ include/net/mac80211.h | 1 +
+ include/uapi/linux/nl80211.h | 1 +
+ net/mac80211/cfg.c | 32 +++++++++++++++++++++++++++++++-
+ net/wireless/nl80211.c | 31 +++++++++++++++++++++++++++----
+ 5 files changed, 61 insertions(+), 5 deletions(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 8e05f55..ae2af09 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -1158,6 +1158,7 @@ struct cfg80211_fils_discovery {
+ u32 max_interval;
+ size_t tmpl_len;
+ const u8 *tmpl;
++ u8 disable;
+ };
+
+ /**
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 4d3cfb1..66fedf6 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -505,6 +505,7 @@ struct ieee80211_ftm_responder_params {
+ struct ieee80211_fils_discovery {
+ u32 min_interval;
+ u32 max_interval;
++ u8 disable;
+ };
+
+ /**
+diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
+index 019f065..e674aa7 100644
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -7242,6 +7242,7 @@ enum nl80211_fils_discovery_attributes {
+ NL80211_FILS_DISCOVERY_ATTR_INT_MIN,
+ NL80211_FILS_DISCOVERY_ATTR_INT_MAX,
+ NL80211_FILS_DISCOVERY_ATTR_TMPL,
++ NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
+
+ /* keep last */
+ __NL80211_FILS_DISCOVERY_ATTR_LAST,
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index abe7318..bf71594 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -906,6 +906,7 @@ static int ieee80211_set_fils_discovery(struct ieee80211_sub_if_data *sdata,
+ fd = &sdata->vif.bss_conf.fils_discovery;
+ fd->min_interval = params->min_interval;
+ fd->max_interval = params->max_interval;
++ fd->disable = params->disable;
+
+ old = sdata_dereference(sdata->u.ap.fils_discovery, sdata);
+ new = kzalloc(sizeof(*new) + params->tmpl_len, GFP_KERNEL);
+@@ -1316,6 +1317,9 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
+ {
+ struct ieee80211_sub_if_data *sdata;
+ struct beacon_data *old;
++ struct cfg80211_ap_settings *ap_params;
++ struct ieee80211_supported_band *sband;
++ u32 changed;
+ int err;
+
+ sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+@@ -1334,7 +1338,33 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
+ err = ieee80211_assign_beacon(sdata, params, NULL, NULL);
+ if (err < 0)
+ return err;
+- ieee80211_bss_info_change_notify(sdata, err);
++
++ changed = err;
++
++ sband = ieee80211_get_sband(sdata);
++ if (!sband)
++ return -EINVAL;
++
++ if (sband->band == NL80211_BAND_6GHZ) {
++ ap_params = container_of(params, struct cfg80211_ap_settings, beacon);
++
++ if(ap_params->unsol_bcast_probe_resp.interval) {
++ err = ieee80211_set_unsol_bcast_probe_resp(sdata,
++ &ap_params->unsol_bcast_probe_resp);
++ if (err < 0)
++ return err;
++ changed |= BSS_CHANGED_UNSOL_BCAST_PROBE_RESP;
++ } else {
++ err = ieee80211_set_fils_discovery(sdata,
++ &ap_params->fils_discovery);
++
++ if (err < 0)
++ return err;
++ changed |= BSS_CHANGED_FILS_DISCOVERY;
++ }
++ }
++
++ ieee80211_bss_info_change_notify(sdata, changed);
+ return 0;
+ }
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 1292634..a20aba5 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -421,6 +421,7 @@ nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
+ [NL80211_FILS_DISCOVERY_ATTR_TMPL] = { .type = NLA_BINARY,
+ .len = IEEE80211_MAX_DATA_LEN },
+ #endif
++ [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE] = NLA_POLICY_MAX(NLA_U32, 20),
+ };
+
+ static const struct nla_policy
+@@ -5364,6 +5365,8 @@ static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
+ fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
+ fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
+ fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
++ fd->disable = !(fd->max_interval ||
++ nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE]));
+
+ return 0;
+ }
+@@ -5769,7 +5772,8 @@ static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
+ struct cfg80211_registered_device *rdev = info->user_ptr[0];
+ struct net_device *dev = info->user_ptr[1];
+ struct wireless_dev *wdev = dev->ieee80211_ptr;
+- struct cfg80211_beacon_data params;
++ struct cfg80211_ap_settings ap_params;
++ struct cfg80211_beacon_data *params;
+ int err;
+
+ if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+@@ -5782,16 +5786,35 @@ static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
+ if (!wdev->beacon_interval)
+ return -EINVAL;
+
+- err = nl80211_parse_beacon(rdev, info->attrs, ¶ms);
++ memset(&ap_params, 0, sizeof(ap_params));
++ params = &ap_params.beacon;
++
++ err = nl80211_parse_beacon(rdev, info->attrs, params);
+ if (err)
+ goto out;
+
++ if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
++ err = nl80211_parse_fils_discovery(rdev,
++ info->attrs[NL80211_ATTR_FILS_DISCOVERY],
++ &ap_params);
++ if (err)
++ goto out;
++ }
++
++ if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
++ err = nl80211_parse_unsol_bcast_probe_resp(rdev,
++ info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
++ &ap_params);
++ if (err)
++ goto out;
++ }
++
+ wdev_lock(wdev);
+- err = rdev_change_beacon(rdev, dev, ¶ms);
++ err = rdev_change_beacon(rdev, dev, params);
+ wdev_unlock(wdev);
+
+ out:
+- kfree(params.mbssid_ies);
++ kfree(params->mbssid_ies);
+ return err;
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/906-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robus.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/906-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robus.patch
new file mode 100644
index 0000000..3e40887
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/906-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robus.patch
@@ -0,0 +1,26 @@
+From ae2162e1fe69af7ecc0c0ab5e8c2411ed2d5e77b Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Wed, 8 Jun 2022 10:26:39 +0800
+Subject: [PATCH 906/911] mac80211: mtk: add s1g category to
+ _ieee80211_is_robust_mgmt_frame
+
+Unprotected S1G with code 22 is not robust mgmt frame.
+---
+ include/linux/ieee80211.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index 00ed7c1..59de3dc 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -3700,6 +3700,7 @@ static inline bool _ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
+ *category != WLAN_CATEGORY_SELF_PROTECTED &&
+ *category != WLAN_CATEGORY_UNPROT_DMG &&
+ *category != WLAN_CATEGORY_VHT &&
++ *category != WLAN_CATEGORY_S1G &&
+ *category != WLAN_CATEGORY_VENDOR_SPECIFIC;
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/907-mac80211-mtk-make-4addr-null-frames-using-min_rate-f.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/907-mac80211-mtk-make-4addr-null-frames-using-min_rate-f.patch
new file mode 100644
index 0000000..abf673b
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/907-mac80211-mtk-make-4addr-null-frames-using-min_rate-f.patch
@@ -0,0 +1,31 @@
+From 59a306cfe40a251e8c5deaa30367aa56cfc81d4b Mon Sep 17 00:00:00 2001
+From: Lian Chen <lian.chen@mediatek.com>
+Date: Thu, 14 Jul 2022 16:33:58 +0800
+Subject: [PATCH 907/911] mac80211: mtk: make 4addr null frames using min_rate
+ for WDS
+
+WDS needs 4addr packets to trigger AP for wlan0.sta creation.
+However, the 4addr null frame is sent at a high rate
+so that AP can't receive it.
+This PATCHES switches to use min_rate.
+
+Signed-off-by: Lian Chen <lian.chen@mediatek.com>
+---
+ net/mac80211/mlme.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index cc6d38a..f97bf2b 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1133,6 +1133,7 @@ void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
+ memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
+
+ IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
++ IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
+ ieee80211_tx_skb(sdata, skb);
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/908-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/908-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
new file mode 100644
index 0000000..9fe63f2
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/908-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
@@ -0,0 +1,35 @@
+From 7f8cf0873db7d96ceba1dc30804ff16a86e81e6b Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Wed, 19 Oct 2022 13:49:21 +0800
+Subject: [PATCH 908/911] mac80211: mtk: remove timerout handle for ax210 iot
+ issue
+
+Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+---
+ net/mac80211/agg-tx.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+ mode change 100644 => 100755 net/mac80211/agg-tx.c
+
+diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
+old mode 100644
+new mode 100755
+index 1deb3d8..c30f02d
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -568,10 +568,9 @@ static void sta_tx_agg_session_timer_expired(struct timer_list *t)
+ }
+
+ timeout = tid_tx->last_tx + TU_TO_JIFFIES(tid_tx->timeout);
+- if (time_is_after_jiffies(timeout)) {
+- mod_timer(&tid_tx->session_timer, timeout);
+- return;
+- }
++ /* remove timerout handle for ax210 iot issue */
++ mod_timer(&tid_tx->session_timer, timeout);
++ return;
+
+ ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n",
+ sta->sta.addr, tid);
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/909-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/909-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
new file mode 100644
index 0000000..b2c2cff
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/909-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
@@ -0,0 +1,458 @@
+From 6d245b62cf147bb813898da2ccb43a14ae0fac5c Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 22 Sep 2022 14:27:41 +0800
+Subject: [PATCH 909/911] cfg80211: mtk: implement DFS status show, cac and nop
+ skip command via debugfs
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ include/net/cfg80211.h | 1 +
+ net/mac80211/cfg.c | 19 +++
+ net/wireless/core.h | 3 +
+ net/wireless/debugfs.c | 270 ++++++++++++++++++++++++++++++++++++++--
+ net/wireless/mlme.c | 6 +
+ net/wireless/rdev-ops.h | 14 +++
+ net/wireless/trace.h | 12 ++
+ 7 files changed, 318 insertions(+), 7 deletions(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index ae2af09..b97ddbd 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4401,6 +4401,7 @@ struct cfg80211_ops {
+ struct cfg80211_color_change_settings *params);
+ int (*set_radar_background)(struct wiphy *wiphy,
+ struct cfg80211_chan_def *chandef);
++ void (*skip_cac)(struct wireless_dev *wdev);
+ };
+
+ /*
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index bf71594..97c5e5d 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4504,6 +4504,24 @@ ieee80211_set_radar_background(struct wiphy *wiphy,
+ return local->ops->set_radar_background(&local->hw, chandef);
+ }
+
++static void
++ieee80211_skip_cac(struct wireless_dev *wdev)
++{
++ struct net_device *dev = wdev->netdev;
++ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++ unsigned int cac_time_ms;
++
++ cancel_delayed_work(&sdata->dfs_cac_timer_work);
++ if (wdev->cac_started) {
++ ieee80211_vif_release_channel(sdata);
++ cac_time_ms = wdev->cac_time_ms;
++ wdev->cac_start_time = jiffies -
++ msecs_to_jiffies(cac_time_ms + 1);
++ cfg80211_cac_event(wdev->netdev, &wdev->chandef,
++ NL80211_RADAR_CAC_FINISHED, GFP_KERNEL);
++ }
++}
++
+ const struct cfg80211_ops mac80211_config_ops = {
+ .add_virtual_intf = ieee80211_add_iface,
+ .del_virtual_intf = ieee80211_del_iface,
+@@ -4610,4 +4628,5 @@ const struct cfg80211_ops mac80211_config_ops = {
+ .set_sar_specs = ieee80211_set_sar_specs,
+ .color_change = ieee80211_color_change,
+ .set_radar_background = ieee80211_set_radar_background,
++ .skip_cac = ieee80211_skip_cac,
+ };
+diff --git a/net/wireless/core.h b/net/wireless/core.h
+index b588e5a..10e8981 100644
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -86,6 +86,9 @@ struct cfg80211_registered_device {
+
+ struct wireless_dev *background_radar_wdev;
+ struct cfg80211_chan_def background_radar_chandef;
++ bool background_cac_started;
++ unsigned long background_cac_start_time;
++ unsigned int background_cac_time_ms;
+ struct delayed_work background_cac_done_wk;
+ struct work_struct background_cac_abort_wk;
+
+diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
+index 0878b16..ea50cc7 100644
+--- a/net/wireless/debugfs.c
++++ b/net/wireless/debugfs.c
+@@ -9,6 +9,7 @@
+ #include <linux/slab.h>
+ #include "core.h"
+ #include "debugfs.h"
++#include "rdev-ops.h"
+
+ #define DEBUGFS_READONLY_FILE(name, buflen, fmt, value...) \
+ static ssize_t name## _read(struct file *file, char __user *userbuf, \
+@@ -96,16 +97,271 @@ static const struct file_operations ht40allow_map_ops = {
+ .llseek = default_llseek,
+ };
+
+-#define DEBUGFS_ADD(name) \
+- debugfs_create_file(#name, 0444, phyd, &rdev->wiphy, &name## _ops)
++static int dfs_print_chan(struct ieee80211_channel *chan, int remain_time, int wait_time,
++ char *buf, int buf_size, int offset, bool is_background)
++{
++ if (WARN_ON(offset > buf_size))
++ return 0;
++
++ if (chan->dfs_state == NL80211_DFS_UNAVAILABLE) {
++ offset += scnprintf(buf + offset, buf_size - offset,
++ " Channel = %d, DFS_state = Unavailable",
++ chan->hw_value);
++ if (remain_time > 0)
++ offset += scnprintf(buf + offset, buf_size - offset,
++ ", Non-occupancy Remain Time = %d / %d [sec]",
++ remain_time, wait_time);
++ else
++ offset += scnprintf(buf + offset, buf_size - offset,
++ ", Changing state...");
++ } else if (chan->dfs_state == NL80211_DFS_USABLE) {
++ offset += scnprintf(buf + offset, buf_size - offset,
++ " Channel = %d, DFS_state = Usable",
++ chan->hw_value);
++ if (remain_time > 0)
++ offset += scnprintf(buf + offset, buf_size - offset,
++ ", CAC Remain Time = %d / %d [sec]",
++ remain_time, wait_time);
++ } else if (chan->dfs_state == NL80211_DFS_AVAILABLE) {
++ offset += scnprintf(buf + offset, buf_size - offset,
++ " Channel = %d, DFS_state = Available",
++ chan->hw_value);
++ } else {
++ offset += scnprintf(buf + offset, buf_size - offset,
++ " Channel = %d, DFS_state = Unknown",
++ chan->hw_value);
++ }
++
++ if (is_background)
++ offset += scnprintf(buf + offset, buf_size - offset,
++ " (background chain)");
++ offset += scnprintf(buf + offset, buf_size - offset, "\n");
++
++ return offset;
++}
++
++static int dfs_status_read_wdev(struct wiphy *wiphy, struct wireless_dev *wdev, char *buf,
++ unsigned int buf_size, unsigned int offset)
++{
++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++ struct cfg80211_chan_def *chandef = &wdev->chandef;
++ struct cfg80211_chan_def *background_chandef = &rdev->background_radar_chandef;
++ enum nl80211_band band;
++ struct ieee80211_supported_band *sband;
++ struct ieee80211_channel *chan;
++ unsigned long jiffies_passed;
++ int i, remain_time = 0, wait_time_ms = 0;
++ bool is_background;
++
++ offset += scnprintf(buf + offset, buf_size - offset, "DFS Channel:\n");
++
++ for (band = 0; band < NUM_NL80211_BANDS; band++) {
++ sband = wiphy->bands[band];
++ if (!sband)
++ continue;
++ for (i = 0; i < sband->n_channels; i++) {
++ is_background = false;
++ chan = &sband->channels[i];
++
++ if (!(chan->flags & IEEE80211_CHAN_RADAR))
++ continue;
++
++ if (chan->dfs_state == NL80211_DFS_UNAVAILABLE) {
++ jiffies_passed = jiffies - chan->dfs_state_entered;
++ wait_time_ms = IEEE80211_DFS_MIN_NOP_TIME_MS;
++ remain_time = (wait_time_ms - jiffies_to_msecs(jiffies_passed));
++ if (remain_time > wait_time_ms)
++ remain_time = 0;
++ } else if (chan->dfs_state == NL80211_DFS_USABLE) {
++ if (wdev->cac_started && cfg80211_is_sub_chan(chandef, chan)) {
++ jiffies_passed = jiffies - wdev->cac_start_time;
++ wait_time_ms = wdev->cac_time_ms;
++ remain_time = (wait_time_ms -
++ jiffies_to_msecs(jiffies_passed));
++ }
++
++ if (rdev->background_radar_wdev == wdev &&
++ rdev->background_cac_started &&
++ cfg80211_is_sub_chan(background_chandef, chan)) {
++ jiffies_passed = jiffies - rdev->background_cac_start_time;
++ wait_time_ms = rdev->background_cac_time_ms;
++ remain_time = (wait_time_ms -
++ jiffies_to_msecs(jiffies_passed));
++ is_background = true;
++ }
++
++ if (remain_time > wait_time_ms)
++ remain_time = 0;
++
++ } else {
++ if (rdev->background_radar_wdev == wdev &&
++ cfg80211_is_sub_chan(background_chandef, chan))
++ is_background = true;
++ }
++
++ offset = dfs_print_chan(chan, remain_time / 1000, wait_time_ms / 1000,
++ buf, buf_size, offset, is_background);
++ remain_time = 0;
++ }
++ }
++
++ return offset;
++}
++
++static ssize_t dfs_status_read(struct file *file, char __user *user_buf,
++ size_t count, loff_t *ppos)
++{
++ struct wiphy *wiphy = file->private_data;
++ struct wireless_dev *wdev;
++ char *buf;
++ unsigned int offset = 0, buf_size = PAGE_SIZE, r;
++ const char * const iftype_str[] = {
++ [NL80211_IFTYPE_UNSPECIFIED] = "unspecified",
++ [NL80211_IFTYPE_ADHOC] = "adhoc",
++ [NL80211_IFTYPE_STATION] = "station",
++ [NL80211_IFTYPE_AP] = "ap",
++ [NL80211_IFTYPE_AP_VLAN] = "ap vlan",
++ [NL80211_IFTYPE_WDS] = "wds",
++ [NL80211_IFTYPE_MONITOR] = "monitor",
++ [NL80211_IFTYPE_MESH_POINT] = "mesh point",
++ [NL80211_IFTYPE_P2P_CLIENT] = "p2p client",
++ [NL80211_IFTYPE_P2P_GO] = "p2p go",
++ [NL80211_IFTYPE_P2P_DEVICE] = "p2p device",
++ [NL80211_IFTYPE_OCB] = "ocb",
++ [NL80211_IFTYPE_NAN] = "nan",
++ };
++
++ buf = kzalloc(buf_size, GFP_KERNEL);
++ if (!buf)
++ return -ENOMEM;
++
++ list_for_each_entry(wdev, &wiphy->wdev_list, list) {
++ offset += scnprintf(buf + offset, buf_size - offset,
++ "wdev 0x%x\n"
++ "interface type %s\n",
++ wdev->identifier, iftype_str[wdev->iftype]);
++ offset = dfs_status_read_wdev(wiphy, wdev, buf, buf_size, offset);
++ }
++
++ r = simple_read_from_buffer(user_buf, count, ppos, buf, offset);
++
++ kfree(buf);
++
++ return r;
++}
++
++static const struct file_operations dfs_status_ops = {
++ .read = dfs_status_read,
++ .open = simple_open,
++ .llseek = default_llseek,
++};
++
++static int
++dfs_nop_skip(void *data, u64 val)
++{
++ struct wiphy *wiphy = data;
++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++ bool en = !!val;
++ enum nl80211_band band;
++ struct ieee80211_supported_band *sband;
++ struct ieee80211_channel *chan;
++ u32 nop_time = IEEE80211_DFS_MIN_NOP_TIME_MS;
++ int i;
++
++ if (!en)
++ return 0;
++
++ for (band = 0; band < NUM_NL80211_BANDS; band++) {
++ sband = wiphy->bands[band];
++ if (!sband)
++ continue;
++ for (i = 0; i < sband->n_channels; i++) {
++ chan = &sband->channels[i];
++
++ if (!(chan->flags & IEEE80211_CHAN_RADAR))
++ continue;
++
++ if (chan->dfs_state == NL80211_DFS_UNAVAILABLE) {
++ // Let current jiffies > dfs_state_entered_jiffies + NOP time
++ chan->dfs_state_entered = jiffies -
++ msecs_to_jiffies(nop_time + 1);
++ }
++ }
++ }
++
++ cfg80211_sched_dfs_chan_update(rdev);
++
++ return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(dfs_skip_nop_ops, NULL,
++ dfs_nop_skip, "0x%08llx\n");
++
++static int
++dfs_cac_skip(void *data, u64 val)
++{
++#define CAC_SKIP_MASK BIT(0)
++#define CAC_SKIP_BACKGROUND_MASK BIT(1)
++ struct wiphy *wiphy = data;
++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++ struct wireless_dev *wdev;
++ struct cfg80211_chan_def *chandef;
++ unsigned int skip_mode = val;
++ unsigned long cac_time;
++ struct ieee80211_channel *chan;
++
++ if (!skip_mode || skip_mode > (CAC_SKIP_MASK | CAC_SKIP_BACKGROUND_MASK))
++ return 0;
++
++ list_for_each_entry(wdev, &wiphy->wdev_list, list) {
++ if ((skip_mode & CAC_SKIP_MASK) && wdev->chandef.chan) {
++ chandef = &wdev->chandef;
++ chan = chandef->chan;
++
++ if ((chan->flags & IEEE80211_CHAN_RADAR) &&
++ chan->dfs_state == NL80211_DFS_USABLE && wdev->cac_started) {
++ rdev_skip_cac(rdev, wdev);
++ }
++ }
++
++ if ((skip_mode & CAC_SKIP_BACKGROUND_MASK) &&
++ rdev->background_radar_wdev == wdev &&
++ rdev->background_radar_chandef.chan) {
++ chandef = &rdev->background_radar_chandef;
++ chan = chandef->chan;
++
++ if ((chan->flags & IEEE80211_CHAN_RADAR) &&
++ chan->dfs_state == NL80211_DFS_USABLE &&
++ rdev->background_cac_started) {
++ // Let current jiffies > dfs_state_entered_jiffies + CAC time
++ cac_time = rdev->background_cac_time_ms;
++ rdev->background_cac_start_time = jiffies -
++ msecs_to_jiffies(cac_time + 1);
++ cancel_delayed_work(&rdev->background_cac_done_wk);
++ queue_delayed_work(cfg80211_wq, &rdev->background_cac_done_wk, 0);
++ }
++ }
++ }
++
++ return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(dfs_skip_cac_ops, NULL,
++ dfs_cac_skip, "0x%08llx\n");
++
++#define DEBUGFS_ADD(name, chmod) \
++ debugfs_create_file(#name, chmod, phyd, &rdev->wiphy, &name## _ops)
+
+ void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev)
+ {
+ struct dentry *phyd = rdev->wiphy.debugfsdir;
+
+- DEBUGFS_ADD(rts_threshold);
+- DEBUGFS_ADD(fragmentation_threshold);
+- DEBUGFS_ADD(short_retry_limit);
+- DEBUGFS_ADD(long_retry_limit);
+- DEBUGFS_ADD(ht40allow_map);
++ DEBUGFS_ADD(rts_threshold, 0444);
++ DEBUGFS_ADD(fragmentation_threshold, 0444);
++ DEBUGFS_ADD(short_retry_limit, 0444);
++ DEBUGFS_ADD(long_retry_limit, 0444);
++ DEBUGFS_ADD(ht40allow_map, 0444);
++ DEBUGFS_ADD(dfs_status, 0444);
++ DEBUGFS_ADD(dfs_skip_nop, 0600);
++ DEBUGFS_ADD(dfs_skip_cac, 0600);
+ }
+diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
+index 00370ca..205c1bc 100644
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -998,13 +998,16 @@ __cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
+ queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
+ cfg80211_sched_dfs_chan_update(rdev);
+ wdev = rdev->background_radar_wdev;
++ rdev->background_cac_started = false;
+ break;
+ case NL80211_RADAR_CAC_ABORTED:
+ if (!cancel_delayed_work(&rdev->background_cac_done_wk))
+ return;
+ wdev = rdev->background_radar_wdev;
++ rdev->background_cac_started = false;
+ break;
+ case NL80211_RADAR_CAC_STARTED:
++ rdev->background_cac_started = true;
+ break;
+ default:
+ return;
+@@ -1024,6 +1027,7 @@ cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
+ chandef, event);
+ wiphy_unlock(&rdev->wiphy);
+ }
++EXPORT_SYMBOL(cfg80211_background_cac_event);
+
+ void cfg80211_background_cac_done_wk(struct work_struct *work)
+ {
+@@ -1085,8 +1089,10 @@ cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rde
+ if (!cac_time_ms)
+ cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+
++ rdev->background_cac_time_ms = cac_time_ms;
+ rdev->background_radar_chandef = *chandef;
+ rdev->background_radar_wdev = wdev; /* Get offchain ownership */
++ rdev->background_cac_start_time = jiffies;
+
+ __cfg80211_background_cac_event(rdev, wdev, chandef,
+ NL80211_RADAR_CAC_STARTED);
+diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
+index 8555468..26f4604 100644
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -1398,4 +1398,18 @@ rdev_set_radar_background(struct cfg80211_registered_device *rdev,
+ return ret;
+ }
+
++static inline int
++rdev_skip_cac(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev)
++{
++ if (!rdev->ops->skip_cac)
++ return -EOPNOTSUPP;
++
++ trace_rdev_skip_cac(wdev);
++ rdev->ops->skip_cac(wdev);
++ trace_rdev_return_void(&rdev->wiphy);
++
++ return 0;
++}
++
+ #endif /* __CFG80211_RDEV_OPS */
+diff --git a/net/wireless/trace.h b/net/wireless/trace.h
+index 97a2937..eadabfa 100644
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3665,6 +3665,18 @@ TRACE_EVENT(rdev_set_radar_background,
+ WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
+ );
+
++TRACE_EVENT(rdev_skip_cac,
++ TP_PROTO(struct wireless_dev *wdev),
++
++ TP_ARGS(wdev),
++
++ TP_STRUCT__entry(WDEV_ENTRY),
++
++ TP_fast_assign(WDEV_ASSIGN;),
++
++ TP_printk(WDEV_PR_FMT, WDEV_PR_ARG)
++);
++
+ #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
+
+ #undef TRACE_INCLUDE_PATH
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/910-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/910-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
new file mode 100644
index 0000000..515ed03
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/910-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
@@ -0,0 +1,26 @@
+From e70aa68fef1e04812c3a3ba57ad1f525302accd7 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Tue, 4 Oct 2022 10:47:05 +0800
+Subject: [PATCH 910/911] mac80211: mtk: Set TWT Information Frame Disabled bit
+ as 1.
+
+This modification means that current implementation do not support twt information frame.
+---
+ net/mac80211/s1g.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/mac80211/s1g.c b/net/mac80211/s1g.c
+index 4141bc8..82da404 100644
+--- a/net/mac80211/s1g.c
++++ b/net/mac80211/s1g.c
+@@ -101,6 +101,7 @@ ieee80211_s1g_rx_twt_setup(struct ieee80211_sub_if_data *sdata,
+ struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
+
+ twt_agrt->req_type &= cpu_to_le16(~IEEE80211_TWT_REQTYPE_REQUEST);
++ twt->control |= IEEE80211_TWT_CONTROL_RX_DISABLED;
+
+ /* broadcast TWT not supported yet */
+ if (twt->control & IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST) {
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/911-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/911-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
new file mode 100644
index 0000000..1199df9
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/911-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
@@ -0,0 +1,258 @@
+From c3fa5e627f8c552852ee25ab366b4035c203aab3 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Wed, 5 Oct 2022 19:13:43 +0800
+Subject: [PATCH 911/911] mac80211: mtk: fix the issue of AP and STA starting
+ on DFS channel concurrently
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ include/net/cfg80211.h | 21 +++++++++++++++++
+ include/uapi/linux/nl80211.h | 2 +-
+ net/mac80211/cfg.c | 44 ++++++++++++++++++++++++++++++++++++
+ net/mac80211/chan.c | 2 +-
+ net/wireless/chan.c | 6 ++---
+ net/wireless/nl80211.c | 8 +++++++
+ net/wireless/rdev-ops.h | 16 +++++++++++++
+ net/wireless/trace.h | 15 ++++++++++++
+ 8 files changed, 109 insertions(+), 5 deletions(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index b97ddbd..c4c0926 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -800,6 +800,24 @@ cfg80211_chandef_identical(const struct cfg80211_chan_def *chandef1,
+ chandef1->center_freq2 == chandef2->center_freq2);
+ }
+
++/**
++ * cfg80211_chan_fully_overlap - check if two channel are fully overlapped
++ * @chandef1: first channel definition
++ * @chandef2: second channel definition
++ *
++ * Return: %true if the channels are valid and fully overlapped, %false otherwise.
++ */
++static inline bool
++cfg80211_chan_fully_overlap(const struct cfg80211_chan_def *chandef1,
++ const struct cfg80211_chan_def *chandef2)
++{
++ return (chandef1->center_freq1 != 0 &&
++ chandef1->center_freq1 == chandef2->center_freq1 &&
++ chandef1->width == chandef2->width &&
++ chandef1->freq1_offset == chandef2->freq1_offset &&
++ chandef1->center_freq2 == chandef2->center_freq2);
++}
++
+ /**
+ * cfg80211_chandef_is_edmg - check if chandef represents an EDMG channel
+ *
+@@ -4402,6 +4420,8 @@ struct cfg80211_ops {
+ int (*set_radar_background)(struct wiphy *wiphy,
+ struct cfg80211_chan_def *chandef);
+ void (*skip_cac)(struct wireless_dev *wdev);
++ void (*check_cac_skip)(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef);
+ };
+
+ /*
+@@ -5555,6 +5575,7 @@ struct wireless_dev {
+ struct work_struct pmsr_free_wk;
+
+ unsigned long unprot_beacon_reported;
++ bool start_disabled;
+ };
+
+ static inline u8 *wdev_address(struct wireless_dev *wdev)
+diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
+index e674aa7..ada8288 100644
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -3129,7 +3129,7 @@ enum nl80211_attrs {
+ NL80211_ATTR_WIPHY_ANTENNA_GAIN,
+
+ /* add attributes here, update the policy in nl80211.c */
+-
++ NL80211_ATTR_START_DISABLED = 999,
+ __NL80211_ATTR_AFTER_LAST,
+ NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
+ NL80211_ATTR_MAX = __NL80211_ATTR_AFTER_LAST - 1
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 97c5e5d..d726410 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4522,6 +4522,49 @@ ieee80211_skip_cac(struct wireless_dev *wdev)
+ }
+ }
+
++static void
++ieee80211_check_cac_skip(struct wiphy *wiphy,
++ struct cfg80211_chan_def *chandef)
++{
++ struct ieee80211_local *local = wiphy_priv(wiphy);
++ struct ieee80211_sub_if_data *s1;
++ struct ieee80211_sub_if_data *s2;
++ struct ieee80211_sub_if_data *sdata_sta;
++ struct ieee80211_if_managed *ifmgd;
++ struct ieee80211_channel *chan;
++ struct wireless_dev *wdev;
++ unsigned int cac_time_ms;
++
++ mutex_lock(&local->mtx);
++ /* Bypass AP's cac if there is a STA associated to the same DFS channel */
++ list_for_each_entry(s1, &local->interfaces, list) {
++ ifmgd = &s1->u.mgd;
++
++ if (s1->vif.type == NL80211_IFTYPE_STATION && ifmgd->associated)
++ sdata_sta = s1;
++ else
++ continue;
++
++ list_for_each_entry(s2, &local->interfaces, list) {
++ wdev = &s2->wdev;
++ chan = wdev->chandef.chan;
++ if (chan) {
++ if (!(chan->flags & IEEE80211_CHAN_RADAR))
++ continue;
++
++ if (wdev->identifier != sdata_sta->wdev.identifier &&
++ chan->dfs_state == NL80211_DFS_USABLE && wdev->cac_started &&
++ cfg80211_chan_fully_overlap(&sdata_sta->vif.bss_conf.chandef,
++ &s2->vif.bss_conf.chandef)) {
++ ieee80211_skip_cac(wdev);
++ sdata_info(s2, "Skip CAC on the associated STA's chan\n");
++ }
++ }
++ }
++ }
++ mutex_unlock(&local->mtx);
++}
++
+ const struct cfg80211_ops mac80211_config_ops = {
+ .add_virtual_intf = ieee80211_add_iface,
+ .del_virtual_intf = ieee80211_del_iface,
+@@ -4629,4 +4672,5 @@ const struct cfg80211_ops mac80211_config_ops = {
+ .color_change = ieee80211_color_change,
+ .set_radar_background = ieee80211_set_radar_background,
+ .skip_cac = ieee80211_skip_cac,
++ .check_cac_skip = ieee80211_check_cac_skip,
+ };
+diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
+index 63e15f5..5e57e4a 100644
+--- a/net/mac80211/chan.c
++++ b/net/mac80211/chan.c
+@@ -505,7 +505,7 @@ bool ieee80211_is_radar_required(struct ieee80211_local *local)
+
+ rcu_read_lock();
+ list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+- if (sdata->radar_required) {
++ if (sdata->radar_required && sdata->wdev.cac_started) {
+ rcu_read_unlock();
+ return true;
+ }
+diff --git a/net/wireless/chan.c b/net/wireless/chan.c
+index 5f50ac4..067ed79 100644
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -664,13 +664,13 @@ bool cfg80211_beaconing_iface_active(struct wireless_dev *wdev)
+ switch (wdev->iftype) {
+ case NL80211_IFTYPE_AP:
+ case NL80211_IFTYPE_P2P_GO:
+- active = wdev->beacon_interval != 0;
++ active = wdev->beacon_interval != 0 || wdev->start_disabled;
+ break;
+ case NL80211_IFTYPE_ADHOC:
+- active = wdev->ssid_len != 0;
++ active = wdev->ssid_len != 0 || wdev->start_disabled;
+ break;
+ case NL80211_IFTYPE_MESH_POINT:
+- active = wdev->mesh_id_len != 0;
++ active = wdev->mesh_id_len != 0 || wdev->start_disabled;
+ break;
+ case NL80211_IFTYPE_STATION:
+ case NL80211_IFTYPE_OCB:
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index a20aba5..8dc928d 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -803,6 +803,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
+ [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
+ [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
++ [NL80211_ATTR_START_DISABLED] = { .type = NLA_FLAG },
+ [NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
+ };
+
+@@ -5547,6 +5548,12 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
+
+ memset(¶ms, 0, sizeof(params));
+
++ if (info->attrs[NL80211_ATTR_START_DISABLED]) {
++ wdev->start_disabled = nla_get_flag(info->attrs[NL80211_ATTR_START_DISABLED]);
++ err = 0;
++ goto out;
++ }
++
+ /* these are required for START_AP */
+ if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
+ !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
+@@ -9393,6 +9400,7 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
+ wdev->cac_started = true;
+ wdev->cac_start_time = jiffies;
+ wdev->cac_time_ms = cac_time_ms;
++ err = rdev_check_cac_skip(rdev, &wdev->chandef);
+ }
+ unlock:
+ wiphy_unlock(wiphy);
+diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
+index 26f4604..c38aea1 100644
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -1412,4 +1412,20 @@ rdev_skip_cac(struct cfg80211_registered_device *rdev,
+ return 0;
+ }
+
++static inline int
++rdev_check_cac_skip(struct cfg80211_registered_device *rdev,
++ struct cfg80211_chan_def *chandef)
++{
++ struct wiphy *wiphy = &rdev->wiphy;
++
++ if (!rdev->ops->check_cac_skip)
++ return -EOPNOTSUPP;
++
++ trace_rdev_check_cac_skip(wiphy, chandef);
++ rdev->ops->check_cac_skip(wiphy, chandef);
++ trace_rdev_return_void(wiphy);
++
++ return 0;
++}
++
+ #endif /* __CFG80211_RDEV_OPS */
+diff --git a/net/wireless/trace.h b/net/wireless/trace.h
+index eadabfa..a7b0c82 100644
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3677,6 +3677,21 @@ TRACE_EVENT(rdev_skip_cac,
+ TP_printk(WDEV_PR_FMT, WDEV_PR_ARG)
+ );
+
++TRACE_EVENT(rdev_check_cac_skip,
++ TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
++
++ TP_ARGS(wiphy, chandef),
++
++ TP_STRUCT__entry(WIPHY_ENTRY
++ CHAN_DEF_ENTRY),
++
++ TP_fast_assign(WIPHY_ASSIGN;
++ CHAN_DEF_ASSIGN(chandef)),
++
++ TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
++ WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
++);
++
+ #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
+
+ #undef TRACE_INCLUDE_PATH
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99900-mac80211-mtk-mask-kernel-version-limitation-and-fil.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99900-mac80211-mtk-mask-kernel-version-limitation-and-fil.patch
new file mode 100644
index 0000000..a2d862c
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99900-mac80211-mtk-mask-kernel-version-limitation-and-fil.patch
@@ -0,0 +1,103 @@
+From d364b3a664a76fdb9b0e95e84e092d41d4f2ddd5 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 11 Mar 2022 11:34:11 +0800
+Subject: [PATCH 99900/99901] mac80211: mtk: mask kernel version limitation and
+ fill forward path in kernel 5.4
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ include/net/mac80211.h | 2 --
+ net/mac80211/driver-ops.h | 2 --
+ net/mac80211/iface.c | 4 ----
+ net/mac80211/trace.h | 2 --
+ 4 files changed, 10 deletions(-)
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 66fedf6..95e5e66 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -4292,13 +4292,11 @@ struct ieee80211_ops {
+ struct ieee80211_sta *sta, u8 flowid);
+ int (*set_radar_background)(struct ieee80211_hw *hw,
+ struct cfg80211_chan_def *chandef);
+-#if LINUX_VERSION_IS_GEQ(5,10,0)
+ int (*net_fill_forward_path)(struct ieee80211_hw *hw,
+ struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta,
+ struct net_device_path_ctx *ctx,
+ struct net_device_path *path);
+-#endif
+ };
+
+ /**
+diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
+index 2df420b..d2b68ef 100644
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1486,7 +1486,6 @@ static inline void drv_twt_teardown_request(struct ieee80211_local *local,
+ trace_drv_return_void(local);
+ }
+
+-#if LINUX_VERSION_IS_GEQ(5,10,0)
+ static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
+ struct ieee80211_sub_if_data *sdata,
+ struct ieee80211_sta *sta,
+@@ -1508,6 +1507,5 @@ static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
+
+ return ret;
+ }
+-#endif
+
+ #endif /* __MAC80211_DRIVER_OPS */
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 717dfda..455791f 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -852,7 +852,6 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
+
+ };
+
+-#if LINUX_VERSION_IS_GEQ(5,10,0)
+ static int ieee80211_netdev_fill_forward_path(struct net_device_path_ctx *ctx,
+ struct net_device_path *path)
+ {
+@@ -910,7 +909,6 @@ out:
+
+ return ret;
+ }
+-#endif
+
+ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+ #if LINUX_VERSION_IS_LESS(4,10,0)
+@@ -929,9 +927,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+ #else
+ .ndo_get_stats64 = bp_ieee80211_get_stats64,
+ #endif
+-#if LINUX_VERSION_IS_GEQ(5,10,0)
+ .ndo_fill_forward_path = ieee80211_netdev_fill_forward_path,
+-#endif
+ };
+
+ static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
+diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
+index bbda9e9..d91498f 100644
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -2892,14 +2892,12 @@ TRACE_EVENT(drv_twt_teardown_request,
+ )
+ );
+
+-#if LINUX_VERSION_IS_GEQ(5,10,0)
+ DEFINE_EVENT(sta_event, drv_net_fill_forward_path,
+ TP_PROTO(struct ieee80211_local *local,
+ struct ieee80211_sub_if_data *sdata,
+ struct ieee80211_sta *sta),
+ TP_ARGS(local, sdata, sta)
+ );
+-#endif
+
+ #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
+
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch
new file mode 100644
index 0000000..6d58e48
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch
@@ -0,0 +1,144 @@
+From f1d42518adad5791f668a46d3cad3a5efc5f0a30 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Wed, 18 May 2022 15:10:22 +0800
+Subject: [PATCH 99901/99901] mac80211: mtk: add fill receive path ops to get
+ wed idx
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ include/net/mac80211.h | 12 ++++++++++++
+ net/mac80211/driver-ops.h | 13 +++++++++++++
+ net/mac80211/iface.c | 24 ++++++++++++++++++++++++
+ net/mac80211/util.c | 9 +++++++++
+ 4 files changed, 58 insertions(+)
+ mode change 100644 => 100755 include/net/mac80211.h
+ mode change 100644 => 100755 net/mac80211/util.c
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+old mode 100644
+new mode 100755
+index 95e5e66..9a38b9f
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1796,6 +1796,13 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
+ */
+ struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif);
+
++/**
++ * ieee80211_vif_to_wdev - return a net_device struct from a vif
++ * @vif: the vif to get the net_device for
++ */
++struct net_device *ieee80211_vif_to_netdev(struct ieee80211_vif *vif);
++
++
+ /**
+ * enum ieee80211_key_flags - key flags
+ *
+@@ -3962,6 +3969,8 @@ struct ieee80211_prep_tx_info {
+ * disable background CAC/radar detection.
+ * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
+ * resolve a path for hardware flow offloading
++ * @net_fill_receive_path: Called from .ndo_fill_receive_path in order to
++ * get a path for hardware flow offloading
+ */
+ struct ieee80211_ops {
+ void (*tx)(struct ieee80211_hw *hw,
+@@ -4297,6 +4306,9 @@ struct ieee80211_ops {
+ struct ieee80211_sta *sta,
+ struct net_device_path_ctx *ctx,
+ struct net_device_path *path);
++ int (*net_fill_receive_path)(struct ieee80211_hw *hw,
++ struct net_device_path_ctx *ctx,
++ struct net_device_path *path);
+ };
+
+ /**
+diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
+index d2b68ef..27da75e 100644
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1508,4 +1508,17 @@ static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
+ return ret;
+ }
+
++static inline int drv_net_fill_receive_path(struct ieee80211_local *local,
++ struct net_device_path_ctx *ctx,
++ struct net_device_path *path)
++{
++ int ret = -EOPNOTSUPP;
++
++ if (local->ops->net_fill_receive_path)
++ ret = local->ops->net_fill_receive_path(&local->hw,
++ ctx, path);
++
++ return ret;
++}
++
+ #endif /* __MAC80211_DRIVER_OPS */
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 455791f..98b2369 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -910,6 +910,29 @@ out:
+ return ret;
+ }
+
++static int ieee80211_netdev_fill_receive_path(struct net_device_path_ctx *ctx,
++ struct net_device_path *path)
++{
++ struct ieee80211_sub_if_data *sdata;
++ struct ieee80211_local *local;
++ int ret = -ENOENT;
++
++ sdata = IEEE80211_DEV_TO_SUB_IF(ctx->dev);
++ local = sdata->local;
++
++ if (!local->ops->net_fill_receive_path)
++ return -EOPNOTSUPP;
++
++ rcu_read_lock();
++
++ ret = drv_net_fill_receive_path(local, ctx, path);
++
++ rcu_read_unlock();
++
++ return ret;
++}
++
++
+ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+ #if LINUX_VERSION_IS_LESS(4,10,0)
+ .ndo_change_mtu = __change_mtu,
+@@ -928,6 +951,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+ .ndo_get_stats64 = bp_ieee80211_get_stats64,
+ #endif
+ .ndo_fill_forward_path = ieee80211_netdev_fill_forward_path,
++ .ndo_fill_receive_path = ieee80211_netdev_fill_receive_path,
+ };
+
+ static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+old mode 100644
+new mode 100755
+index 8d36b05..d26a2b8
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -898,6 +898,15 @@ struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
+ }
+ EXPORT_SYMBOL_GPL(ieee80211_vif_to_wdev);
+
++struct net_device *ieee80211_vif_to_netdev(struct ieee80211_vif *vif)
++{
++ if (!vif)
++ return NULL;
++
++ return vif_to_sdata(vif)->dev;
++}
++EXPORT_SYMBOL_GPL(ieee80211_vif_to_netdev);
++
+ /*
+ * Nothing should have been stuffed into the workqueue during
+ * the suspend->resume cycle. Since we can't check each caller
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
new file mode 100644
index 0000000..355e6bd
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
@@ -0,0 +1,66 @@
+#patch subsys (come from openwrt/lede/target/linux/mediatek)
+SRC_URI_append = " \
+ file://110-mac80211_keep_keys_on_stop_ap.patch \
+ file://120-cfg80211_allow_perm_addr_change.patch \
+ file://150-disable_addr_notifier.patch \
+ file://210-ap_scan.patch \
+ file://301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch \
+ file://303-v5.16-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch \
+ file://306-v5.17-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch \
+ file://307-mac80211_hwsim-make-6-GHz-channels-usable.patch \
+ file://308-v5.17-mac80211-add-support-for-.ndo_fill_forward_path.patch \
+ file://309-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch \
+ file://310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch \
+ file://311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch \
+ file://312-v5.16-mac80211-split-beacon-retrieval-functions.patch \
+ file://313-v5.16-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch \
+ file://314-v5.17-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch \
+ file://315-v5.17-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch \
+ file://316-v5.17-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch \
+ file://317-v5.17-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch \
+ file://318-v5.17-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch \
+ file://319-v5.17-mac80211-introduce-set_radar_offchan-callback.patch \
+ file://320-v5.17-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch \
+ file://323-v5.16-mac80211-MBSSID-support-in-interface-handling.patch \
+ file://324-v5.18-mac80211-MBSSID-beacon-handling-in-AP-mode.patch \
+ file://325-v5.18-mac80211-MBSSID-channel-switch.patch \
+ file://326-v5.18-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch \
+ file://328-v5.19-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch \
+ file://330-v6.0-mac80211-switch-airtime-fairness-back-to-deficit-rou.patch \
+ file://331-v6.0-mac80211-make-sta-airtime-deficit-field-s32-instead-.patch \
+ file://332-v6.0-mac80211-consider-aql_tx_pending-when-checking-airti.patch \
+ file://333-v6.0-mac80211-keep-recently-active-tx-queues-in-schedulin.patch \
+ file://334-v6.0-mac80211-add-a-per-PHY-AQL-limit-to-improve-fairness.patch \
+ file://335-v6.0-mac80211-add-debugfs-file-to-display-per-phy-AQL-pen.patch \
+ file://336-v6.0-mac80211-only-accumulate-airtime-deficit-for-active-.patch \
+ file://337-mac80211-increase-quantum-for-airtime-scheduler.patch \
+ file://339-v6.0-mac80211-exclude-multicast-packets-from-AQL-pending-.patch \
+ file://340-v5.19-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch \
+ file://341-v6.0-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch \
+ file://342-v6.0-mac80211-Ensure-vif-queues-are-operational-after-sta.patch \
+ file://343-v6.1-wifi-mac80211-fix-decap-offload-for-stations-on-AP_V.patch \
+ file://344-v6.1-wifi-cfg80211-fix-ieee80211_data_to_8023_exthdr-hand.patch \
+ file://345-v6.1-wifi-mac80211-do-not-drop-packets-smaller-than-the-L.patch \
+ file://346-v6.0-wifi-mac80211-fix-mesh-airtime-link-metric-estimatin.patch \
+ file://363-v5.19-bss-color-collision.patch \
+ file://364-mac80211-add-support-for-restricting-netdev-features.patch \
+ file://400-allow-ibss-mixed.patch \
+ file://500-mac80211_configure_antenna_gain.patch \
+ file://782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch \
+ file://783-sync-nl80211.patch \
+ file://800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch \
+ file://900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch \
+ file://901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch \
+ file://902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch \
+ file://903-mac80211-mtk-correct-legacy-rates-check-in-ieee80211.patch \
+ file://904-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch \
+ file://905-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch \
+ file://906-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robus.patch \
+ file://907-mac80211-mtk-make-4addr-null-frames-using-min_rate-f.patch \
+ file://908-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch \
+ file://909-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch \
+ file://910-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch \
+ file://911-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch \
+ file://99900-mac80211-mtk-mask-kernel-version-limitation-and-fil.patch \
+ file://99901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch \
+ "
diff --git a/recipes-wifi/linux-mac80211/linux-mac80211.bb b/recipes-wifi/linux-mac80211/linux-mac80211_5.15.%.bb
similarity index 100%
rename from recipes-wifi/linux-mac80211/linux-mac80211.bb
rename to recipes-wifi/linux-mac80211/linux-mac80211_5.15.%.bb
diff --git a/recipes-wifi/linux-mac80211/linux-mac80211_6.x.bb b/recipes-wifi/linux-mac80211/linux-mac80211_6.x.bb
new file mode 100644
index 0000000..2a1ddf3
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/linux-mac80211_6.x.bb
@@ -0,0 +1,74 @@
+DESCRIPTION = "Linux backports"
+HOMEPAGE = "https://backports.wiki.kernel.org"
+SECTION = "kernel/modules"
+LICENSE = "GPLv2"
+LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
+
+inherit module
+
+PV = "6.x"
+
+SRC_URI = " \
+ https://cdn.kernel.org/pub/linux/kernel/projects/backports/stable/v5.15.81/backports-5.15.81-1.tar.xz \
+ file://config \
+ file://0001-rdkb-fix_build_issue-mac80211-without_depmod.patch;apply=no \
+ "
+SRC_URI[sha256sum] = "5227d3c35ccebacfaee6b8180b3a87b9910f3c94ee768ebc5c0fef3c86b6146d"
+
+DEPENDS += "virtual/kernel"
+DEPENDS += "bison-native coreutils-native flex-native"
+
+FILESEXTRAPATHS_prepend := "${THISDIR}/files/patches-6.x/build:"
+FILESEXTRAPATHS_prepend := "${THISDIR}/files/patches-6.x/subsys:"
+
+require files/patches-6.x/build/build.inc
+require files/patches-6.x/subsys/subsys.inc
+
+SRC_URI_remove = "${@bb.utils.contains('DISTRO_FEATURES', 'flow_offload', '', 'file://99900-mac80211-mtk-mask-kernel-version-limitation-and-fil.patch', d)}"
+SRC_URI_remove = "${@bb.utils.contains('DISTRO_FEATURES', 'flow_offload', '', 'file://99901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch', d)}"
+
+S = "${WORKDIR}/backports-5.15.81-1"
+
+do_filogic_patches() {
+ cd ${S}
+ if [ ! -e patch_applied ]; then
+ patch -p1 < ${WORKDIR}/0001-rdkb-fix_build_issue-mac80211-without_depmod.patch
+ touch patch_applied
+ fi
+}
+addtask filogic_patches after do_unpack before do_compile
+
+EXTRA_OEMAKE = " \
+ KLIB_BUILD=${STAGING_KERNEL_BUILDDIR} \
+ KLIB=${D} \
+ "
+
+do_configure () {
+ make CFLAGS="" CPPFLAGS="" CXXFLAGS="" LDFLAGS="" CC="${BUILD_CC}" \
+ LD="${BUILD_LD}" AR="${BUILD_AR}" LEX="flex" -C ${S}/kconf O=${S}/kconf conf
+
+ cp ${WORKDIR}/config ${S}/.config
+ oe_runmake allnoconfig
+}
+
+do_install_prepend () {
+ mkdir -p \
+ ${STAGING_KERNEL_BUILDDIR}/usr/include/mac80211 \
+ ${STAGING_KERNEL_BUILDDIR}/usr/include/mac80211-backport \
+ ${STAGING_KERNEL_BUILDDIR}/usr/include/mac80211/ath \
+ ${STAGING_KERNEL_BUILDDIR}/usr/include/net/mac80211
+ cp -Rf ${S}/net/mac80211/*.h ${S}/include/* ${STAGING_KERNEL_BUILDDIR}/usr/include/mac80211/
+ cp -Rf ${S}/backport-include/* ${STAGING_KERNEL_BUILDDIR}/usr/include/mac80211-backport/
+ cp -Rf ${S}/net/mac80211/rate.h ${STAGING_KERNEL_BUILDDIR}/usr/include/net/mac80211/
+ cp -Rf ${S}/drivers/net/wireless/ath/*.h ${STAGING_KERNEL_BUILDDIR}/usr/include/mac80211/ath/
+ rm -f ${STAGING_KERNEL_BUILDDIR}/usr/include/mac80211-backport/linux/module.h
+}
+
+do_install_append() {
+ # Module
+ cat ${D}/usr/include/linux-mac80211/Module.symvers >> ${TMPDIR}/work-shared/${MACHINE}/kernel-build-artifacts/Module.symvers
+}
+
+PROVIDES += "kernel-module-compat"
+PROVIDES += "kernel-module-cfg80211"
+PROVIDES += "kernel-module-mac80211"
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0000-mt76-sync-to-master-lastest-commit.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0000-mt76-sync-to-master-lastest-commit.patch
new file mode 100644
index 0000000..dc307c3
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0000-mt76-sync-to-master-lastest-commit.patch
@@ -0,0 +1,3283 @@
+From fd9a307422024d5c6e953634129cc2b61425e93f Mon Sep 17 00:00:00 2001
+From: Ryder Lee <ryder.lee@mediatek.com>
+Date: Mon, 14 Nov 2022 10:17:47 +0800
+Subject: [PATCH] mt76: sync to master lastest commit
+
+wifi: mt76: mt7915: fix uninitialized irq_mask
+wifi: mt76: mt7921: introduce remain_on_channel support
+wifi: mt76: connac: rework macros for unified command
+wifi: mt76: connac: update struct sta_rec_phy
+wifi: mt76: connac: rework fields for larger bandwidth support in sta_rec_bf
+wifi: mt76: connac: add more unified command IDs
+wifi: mt76: connac: introduce unified event table
+wifi: mt76: connac: add more bss info command tags
+wifi: mt76: connac: add more starec command tags
+wifi: mt76: connac: introduce helper for mt7996 chipset
+wifi: mt76: mt7921: fix wrong power after multiple SAR set
+wifi: mt76: mt7915: add missing MODULE_PARM_DESC
+wifi: mt76: mt7915: add support to configure spatial reuse parameter set
+wifi: mt76: introduce rxwi and rx token utility routines
+wifi: mt76: add WED RX support to mt76_dma_{add,get}_buf
+wifi: mt76: add WED RX support to mt76_dma_rx_fill
+wifi: mt76: add WED RX support to dma queue alloc
+wifi: mt76: add info parameter to rx_skb signature
+wifi: mt76: connac: introduce mt76_connac_mcu_sta_wed_update utility routine
+wifi: mt76: mt7915: enable WED RX support
+wifi: mt76: mt7915: enable WED RX stats
+wifi: mt76: mt7915: add basedband Txpower info into debugfs
+wifi: mt76: mt7915: enable .sta_set_txpwr support
+wifi: mt76: mt7915: fix band_idx usage
+---
+ dma.c | 244 +++++++++++++++++++++++++-------
+ dma.h | 8 ++
+ mac80211.c | 10 +-
+ mt76.h | 26 +++-
+ mt7603/dma.c | 2 +-
+ mt7603/mt7603.h | 2 +-
+ mt7615/mac.c | 2 +-
+ mt7615/mt7615.h | 2 +-
+ mt76_connac.h | 5 +
+ mt76_connac_mcu.c | 25 +++-
+ mt76_connac_mcu.h | 70 ++++++++-
+ mt76x02.h | 2 +-
+ mt76x02_txrx.c | 2 +-
+ mt7915/coredump.c | 1 +
+ mt7915/debugfs.c | 29 ++--
+ mt7915/dma.c | 26 +++-
+ mt7915/init.c | 3 +
+ mt7915/mac.c | 60 ++++++--
+ mt7915/main.c | 84 ++++++++---
+ mt7915/mcu.c | 354 ++++++++++++++++++++++++++++++++++++++++------
+ mt7915/mcu.h | 30 ++++
+ mt7915/mmio.c | 320 +++++++++++++++++++++++++++++------------
+ mt7915/mt7915.h | 13 +-
+ mt7915/regs.h | 11 ++
+ mt7915/testmode.c | 18 +--
+ mt7921/init.c | 64 +++++++++
+ mt7921/mac.c | 2 +-
+ mt7921/main.c | 118 ++++++++++++++++
+ mt7921/mcu.c | 24 ++++
+ mt7921/mt7921.h | 52 ++++++-
+ mt7921/pci.c | 33 ++++-
+ mt7921/sdio.c | 23 ++-
+ mt7921/usb.c | 12 +-
+ sdio.c | 2 +-
+ tx.c | 30 ++++
+ usb.c | 2 +-
+ 36 files changed, 1438 insertions(+), 273 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index 4b181305..ae22b959 100644
+--- a/dma.c
++++ b/dma.c
+@@ -59,6 +59,19 @@ mt76_alloc_txwi(struct mt76_dev *dev)
+ return t;
+ }
+
++static struct mt76_txwi_cache *
++mt76_alloc_rxwi(struct mt76_dev *dev)
++{
++ struct mt76_txwi_cache *t;
++
++ t = kzalloc(L1_CACHE_ALIGN(sizeof(*t)), GFP_ATOMIC);
++ if (!t)
++ return NULL;
++
++ t->ptr = NULL;
++ return t;
++}
++
+ static struct mt76_txwi_cache *
+ __mt76_get_txwi(struct mt76_dev *dev)
+ {
+@@ -75,6 +88,22 @@ __mt76_get_txwi(struct mt76_dev *dev)
+ return t;
+ }
+
++static struct mt76_txwi_cache *
++__mt76_get_rxwi(struct mt76_dev *dev)
++{
++ struct mt76_txwi_cache *t = NULL;
++
++ spin_lock(&dev->wed_lock);
++ if (!list_empty(&dev->rxwi_cache)) {
++ t = list_first_entry(&dev->rxwi_cache, struct mt76_txwi_cache,
++ list);
++ list_del(&t->list);
++ }
++ spin_unlock(&dev->wed_lock);
++
++ return t;
++}
++
+ static struct mt76_txwi_cache *
+ mt76_get_txwi(struct mt76_dev *dev)
+ {
+@@ -86,6 +115,18 @@ mt76_get_txwi(struct mt76_dev *dev)
+ return mt76_alloc_txwi(dev);
+ }
+
++struct mt76_txwi_cache *
++mt76_get_rxwi(struct mt76_dev *dev)
++{
++ struct mt76_txwi_cache *t = __mt76_get_rxwi(dev);
++
++ if (t)
++ return t;
++
++ return mt76_alloc_rxwi(dev);
++}
++EXPORT_SYMBOL_GPL(mt76_get_rxwi);
++
+ void
+ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
+ {
+@@ -98,6 +139,18 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
+ }
+ EXPORT_SYMBOL_GPL(mt76_put_txwi);
+
++void
++mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
++{
++ if (!t)
++ return;
++
++ spin_lock(&dev->wed_lock);
++ list_add(&t->list, &dev->rxwi_cache);
++ spin_unlock(&dev->wed_lock);
++}
++EXPORT_SYMBOL_GPL(mt76_put_rxwi);
++
+ static void
+ mt76_free_pending_txwi(struct mt76_dev *dev)
+ {
+@@ -112,6 +165,20 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
+ local_bh_enable();
+ }
+
++static void
++mt76_free_pending_rxwi(struct mt76_dev *dev)
++{
++ struct mt76_txwi_cache *t;
++
++ local_bh_disable();
++ while ((t = __mt76_get_rxwi(dev)) != NULL) {
++ if (t->ptr)
++ skb_free_frag(t->ptr);
++ kfree(t);
++ }
++ local_bh_enable();
++}
++
+ static void
+ mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
+ {
+@@ -148,11 +215,6 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
+ u32 ctrl;
+ int i, idx = -1;
+
+- if (txwi) {
+- q->entry[q->head].txwi = DMA_DUMMY_DATA;
+- q->entry[q->head].skip_buf0 = true;
+- }
+-
+ for (i = 0; i < nbufs; i += 2, buf += 2) {
+ u32 buf0 = buf[0].addr, buf1 = 0;
+
+@@ -162,28 +224,48 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
+ desc = &q->desc[idx];
+ entry = &q->entry[idx];
+
+- if (buf[0].skip_unmap)
+- entry->skip_buf0 = true;
+- entry->skip_buf1 = i == nbufs - 1;
+-
+- entry->dma_addr[0] = buf[0].addr;
+- entry->dma_len[0] = buf[0].len;
+-
+- ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
+- if (i < nbufs - 1) {
+- entry->dma_addr[1] = buf[1].addr;
+- entry->dma_len[1] = buf[1].len;
+- buf1 = buf[1].addr;
+- ctrl |= FIELD_PREP(MT_DMA_CTL_SD_LEN1, buf[1].len);
+- if (buf[1].skip_unmap)
+- entry->skip_buf1 = true;
++ if ((q->flags & MT_QFLAG_WED) &&
++ FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
++ struct mt76_txwi_cache *t = txwi;
++ int rx_token;
++
++ if (!t)
++ return -ENOMEM;
++
++ rx_token = mt76_rx_token_consume(dev, (void *)skb, t,
++ buf[0].addr);
++ buf1 |= FIELD_PREP(MT_DMA_CTL_TOKEN, rx_token);
++ ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len) |
++ MT_DMA_CTL_TO_HOST;
++ } else {
++ if (txwi) {
++ q->entry[q->head].txwi = DMA_DUMMY_DATA;
++ q->entry[q->head].skip_buf0 = true;
++ }
++
++ if (buf[0].skip_unmap)
++ entry->skip_buf0 = true;
++ entry->skip_buf1 = i == nbufs - 1;
++
++ entry->dma_addr[0] = buf[0].addr;
++ entry->dma_len[0] = buf[0].len;
++
++ ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
++ if (i < nbufs - 1) {
++ entry->dma_addr[1] = buf[1].addr;
++ entry->dma_len[1] = buf[1].len;
++ buf1 = buf[1].addr;
++ ctrl |= FIELD_PREP(MT_DMA_CTL_SD_LEN1, buf[1].len);
++ if (buf[1].skip_unmap)
++ entry->skip_buf1 = true;
++ }
++
++ if (i == nbufs - 1)
++ ctrl |= MT_DMA_CTL_LAST_SEC0;
++ else if (i == nbufs - 2)
++ ctrl |= MT_DMA_CTL_LAST_SEC1;
+ }
+
+- if (i == nbufs - 1)
+- ctrl |= MT_DMA_CTL_LAST_SEC0;
+- else if (i == nbufs - 2)
+- ctrl |= MT_DMA_CTL_LAST_SEC1;
+-
+ WRITE_ONCE(desc->buf0, cpu_to_le32(buf0));
+ WRITE_ONCE(desc->buf1, cpu_to_le32(buf1));
+ WRITE_ONCE(desc->info, cpu_to_le32(info));
+@@ -272,33 +354,60 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
+
+ static void *
+ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+- int *len, u32 *info, bool *more)
++ int *len, u32 *info, bool *more, bool *drop)
+ {
+ struct mt76_queue_entry *e = &q->entry[idx];
+ struct mt76_desc *desc = &q->desc[idx];
+- dma_addr_t buf_addr;
+- void *buf = e->buf;
+- int buf_len = SKB_WITH_OVERHEAD(q->buf_size);
++ void *buf;
+
+- buf_addr = e->dma_addr[0];
+ if (len) {
+- u32 ctl = le32_to_cpu(READ_ONCE(desc->ctrl));
+- *len = FIELD_GET(MT_DMA_CTL_SD_LEN0, ctl);
+- *more = !(ctl & MT_DMA_CTL_LAST_SEC0);
++ u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
++ *len = FIELD_GET(MT_DMA_CTL_SD_LEN0, ctrl);
++ *more = !(ctrl & MT_DMA_CTL_LAST_SEC0);
+ }
+
+ if (info)
+ *info = le32_to_cpu(desc->info);
+
+- dma_unmap_single(dev->dma_dev, buf_addr, buf_len, DMA_FROM_DEVICE);
+- e->buf = NULL;
++ if ((q->flags & MT_QFLAG_WED) &&
++ FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
++ u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
++ le32_to_cpu(desc->buf1));
++ struct mt76_txwi_cache *t = mt76_rx_token_release(dev, token);
++
++ if (!t)
++ return NULL;
++
++ dma_unmap_single(dev->dma_dev, t->dma_addr,
++ SKB_WITH_OVERHEAD(q->buf_size),
++ DMA_FROM_DEVICE);
++
++ buf = t->ptr;
++ t->dma_addr = 0;
++ t->ptr = NULL;
++
++ mt76_put_rxwi(dev, t);
++
++ if (drop) {
++ u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
++
++ *drop = !!(ctrl & (MT_DMA_CTL_TO_HOST_A |
++ MT_DMA_CTL_DROP));
++ }
++ } else {
++ buf = e->buf;
++ e->buf = NULL;
++ dma_unmap_single(dev->dma_dev, e->dma_addr[0],
++ SKB_WITH_OVERHEAD(q->buf_size),
++ DMA_FROM_DEVICE);
++ }
+
+ return buf;
+ }
+
+ static void *
+ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
+- int *len, u32 *info, bool *more)
++ int *len, u32 *info, bool *more, bool *drop)
+ {
+ int idx = q->tail;
+
+@@ -314,7 +423,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
+ q->tail = (q->tail + 1) % q->ndesc;
+ q->queued--;
+
+- return mt76_dma_get_buf(dev, q, idx, len, info, more);
++ return mt76_dma_get_buf(dev, q, idx, len, info, more, drop);
+ }
+
+ static int
+@@ -441,14 +550,26 @@ free_skb:
+ return ret;
+ }
+
++static struct page_frag_cache *
++mt76_dma_rx_get_frag_cache(struct mt76_dev *dev, struct mt76_queue *q)
++{
++ struct page_frag_cache *rx_page = &q->rx_page;
++
++#ifdef CONFIG_NET_MEDIATEK_SOC_WED
++ if ((q->flags & MT_QFLAG_WED) &&
++ FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX)
++ rx_page = &dev->mmio.wed.rx_buf_ring.rx_page;
++#endif
++ return rx_page;
++}
++
+ static int
+ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ {
+- dma_addr_t addr;
+- void *buf;
+- int frames = 0;
++ struct page_frag_cache *rx_page = mt76_dma_rx_get_frag_cache(dev, q);
+ int len = SKB_WITH_OVERHEAD(q->buf_size);
+- int offset = q->buf_offset;
++ int frames = 0, offset = q->buf_offset;
++ dma_addr_t addr;
+
+ if (!q->ndesc)
+ return 0;
+@@ -456,9 +577,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ spin_lock_bh(&q->lock);
+
+ while (q->queued < q->ndesc - 1) {
++ struct mt76_txwi_cache *t = NULL;
+ struct mt76_queue_buf qbuf;
++ void *buf = NULL;
+
+- buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
++ if ((q->flags & MT_QFLAG_WED) &&
++ FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
++ t = mt76_get_rxwi(dev);
++ if (!t)
++ break;
++ }
++
++ buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
+ if (!buf)
+ break;
+
+@@ -471,7 +601,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ qbuf.addr = addr + offset;
+ qbuf.len = len - offset;
+ qbuf.skip_unmap = false;
+- mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL);
++ mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, t);
+ frames++;
+ }
+
+@@ -517,6 +647,11 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+ if (!ret)
+ q->wed_regs = wed->txfree_ring.reg_base;
+ break;
++ case MT76_WED_Q_RX:
++ ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs);
++ if (!ret)
++ q->wed_regs = wed->rx_ring[ring].reg_base;
++ break;
+ default:
+ ret = -EINVAL;
+ }
+@@ -574,7 +709,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+
+ spin_lock_bh(&q->lock);
+ do {
+- buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more);
++ buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more, NULL);
+ if (!buf)
+ break;
+
+@@ -615,7 +750,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+
+ static void
+ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+- int len, bool more)
++ int len, bool more, u32 info)
+ {
+ struct sk_buff *skb = q->rx_head;
+ struct skb_shared_info *shinfo = skb_shinfo(skb);
+@@ -635,7 +770,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+
+ q->rx_head = NULL;
+ if (nr_frags < ARRAY_SIZE(shinfo->frags))
+- dev->drv->rx_skb(dev, q - dev->q_rx, skb);
++ dev->drv->rx_skb(dev, q - dev->q_rx, skb, &info);
+ else
+ dev_kfree_skb(skb);
+ }
+@@ -656,6 +791,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ }
+
+ while (done < budget) {
++ bool drop = false;
+ u32 info;
+
+ if (check_ddone) {
+@@ -666,10 +802,14 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ break;
+ }
+
+- data = mt76_dma_dequeue(dev, q, false, &len, &info, &more);
++ data = mt76_dma_dequeue(dev, q, false, &len, &info, &more,
++ &drop);
+ if (!data)
+ break;
+
++ if (drop)
++ goto free_frag;
++
+ if (q->rx_head)
+ data_len = q->buf_size;
+ else
+@@ -682,7 +822,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ }
+
+ if (q->rx_head) {
+- mt76_add_fragment(dev, q, data, len, more);
++ mt76_add_fragment(dev, q, data, len, more, info);
+ continue;
+ }
+
+@@ -706,7 +846,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ continue;
+ }
+
+- dev->drv->rx_skb(dev, q - dev->q_rx, skb);
++ dev->drv->rx_skb(dev, q - dev->q_rx, skb, &info);
+ continue;
+
+ free_frag:
+@@ -803,11 +943,15 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+ mt76_dma_tx_cleanup(dev, dev->q_mcu[i], true);
+
+ mt76_for_each_q_rx(dev, i) {
++ struct mt76_queue *q = &dev->q_rx[i];
++
+ netif_napi_del(&dev->napi[i]);
+- mt76_dma_rx_cleanup(dev, &dev->q_rx[i]);
++ if (FIELD_GET(MT_QFLAG_WED_TYPE, q->flags))
++ mt76_dma_rx_cleanup(dev, q);
+ }
+
+ mt76_free_pending_txwi(dev);
++ mt76_free_pending_rxwi(dev);
+
+ if (mtk_wed_device_active(&dev->mmio.wed))
+ mtk_wed_device_detach(&dev->mmio.wed);
+diff --git a/dma.h b/dma.h
+index fdf786f9..53c6ce25 100644
+--- a/dma.h
++++ b/dma.h
+@@ -15,6 +15,14 @@
+ #define MT_DMA_CTL_SD_LEN0 GENMASK(29, 16)
+ #define MT_DMA_CTL_LAST_SEC0 BIT(30)
+ #define MT_DMA_CTL_DMA_DONE BIT(31)
++#define MT_DMA_CTL_TO_HOST BIT(8)
++#define MT_DMA_CTL_TO_HOST_A BIT(12)
++#define MT_DMA_CTL_DROP BIT(14)
++#define MT_DMA_CTL_TOKEN GENMASK(31, 16)
++
++#define MT_DMA_PPE_CPU_REASON GENMASK(15, 11)
++#define MT_DMA_PPE_ENTRY GENMASK(30, 16)
++#define MT_DMA_INFO_PPE_VLD BIT(31)
+
+ #define MT_DMA_HDR_LEN 4
+ #define MT_RX_INFO_LEN 4
+diff --git a/mac80211.c b/mac80211.c
+index 30c1bc56..acac04ef 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -572,6 +572,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+ spin_lock_init(&dev->lock);
+ spin_lock_init(&dev->cc_lock);
+ spin_lock_init(&dev->status_lock);
++ spin_lock_init(&dev->wed_lock);
+ mutex_init(&dev->mutex);
+ init_waitqueue_head(&dev->tx_wait);
+
+@@ -594,9 +595,13 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+ spin_lock_init(&dev->token_lock);
+ idr_init(&dev->token);
+
++ spin_lock_init(&dev->rx_token_lock);
++ idr_init(&dev->rx_token);
++
+ INIT_LIST_HEAD(&dev->wcid_list);
+
+ INIT_LIST_HEAD(&dev->txwi_cache);
++ INIT_LIST_HEAD(&dev->rxwi_cache);
+ dev->token_size = dev->drv->token_size;
+
+ for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
+@@ -1292,7 +1297,10 @@ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
+
+ while ((skb = __skb_dequeue(&dev->rx_skb[q])) != NULL) {
+ mt76_check_sta(dev, skb);
+- mt76_rx_aggr_reorder(skb, &frames);
++ if (mtk_wed_device_active(&dev->mmio.wed))
++ __skb_queue_tail(&frames, skb);
++ else
++ mt76_rx_aggr_reorder(skb, &frames);
+ }
+
+ mt76_rx_complete(dev, &frames, napi);
+diff --git a/mt76.h b/mt76.h
+index a2bccf6b..33f87e51 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -35,6 +35,7 @@
+ FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
+ FIELD_PREP(MT_QFLAG_WED_RING, _n))
+ #define MT_WED_Q_TX(_n) __MT_WED_Q(MT76_WED_Q_TX, _n)
++#define MT_WED_Q_RX(_n) __MT_WED_Q(MT76_WED_Q_RX, _n)
+ #define MT_WED_Q_TXFREE __MT_WED_Q(MT76_WED_Q_TXFREE, 0)
+
+ struct mt76_dev;
+@@ -56,6 +57,7 @@ enum mt76_bus_type {
+ enum mt76_wed_type {
+ MT76_WED_Q_TX,
+ MT76_WED_Q_TXFREE,
++ MT76_WED_Q_RX,
+ };
+
+ struct mt76_bus_ops {
+@@ -271,9 +273,15 @@ struct mt76_sta_stats {
+ u64 tx_nss[4]; /* 1, 2, 3, 4 */
+ u64 tx_mcs[16]; /* mcs idx */
+ u64 tx_bytes;
++ /* WED TX */
+ u32 tx_packets;
+ u32 tx_retries;
+ u32 tx_failed;
++ /* WED RX */
++ u64 rx_bytes;
++ u32 rx_packets;
++ u32 rx_errors;
++ u32 rx_drops;
+ };
+
+ enum mt76_wcid_flags {
+@@ -339,7 +347,10 @@ struct mt76_txwi_cache {
+ struct list_head list;
+ dma_addr_t dma_addr;
+
+- struct sk_buff *skb;
++ union {
++ struct sk_buff *skb;
++ void *ptr;
++ };
+ };
+
+ struct mt76_rx_tid {
+@@ -439,7 +450,7 @@ struct mt76_driver_ops {
+ bool (*rx_check)(struct mt76_dev *dev, void *data, int len);
+
+ void (*rx_skb)(struct mt76_dev *dev, enum mt76_rxq_id q,
+- struct sk_buff *skb);
++ struct sk_buff *skb, u32 *info);
+
+ void (*rx_poll_complete)(struct mt76_dev *dev, enum mt76_rxq_id q);
+
+@@ -728,6 +739,7 @@ struct mt76_dev {
+
+ struct ieee80211_hw *hw;
+
++ spinlock_t wed_lock;
+ spinlock_t lock;
+ spinlock_t cc_lock;
+
+@@ -754,6 +766,7 @@ struct mt76_dev {
+ struct sk_buff_head rx_skb[__MT_RXQ_MAX];
+
+ struct list_head txwi_cache;
++ struct list_head rxwi_cache;
+ struct mt76_queue *q_mcu[__MT_MCUQ_MAX];
+ struct mt76_queue q_rx[__MT_RXQ_MAX];
+ const struct mt76_queue_ops *queue_ops;
+@@ -768,6 +781,10 @@ struct mt76_dev {
+ u16 token_count;
+ u16 token_size;
+
++ spinlock_t rx_token_lock;
++ struct idr rx_token;
++ u16 rx_token_size;
++
+ wait_queue_head_t tx_wait;
+ /* spinclock used to protect wcid pktid linked list */
+ spinlock_t status_lock;
+@@ -1247,6 +1264,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+ }
+
+ void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
++void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
++struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
+ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
+ struct napi_struct *napi);
+ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
+@@ -1391,6 +1410,9 @@ struct mt76_txwi_cache *
+ mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
+ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
+ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
++struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
++int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
++ struct mt76_txwi_cache *r, dma_addr_t phys);
+
+ static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
+ {
+diff --git a/mt7603/dma.c b/mt7603/dma.c
+index 590cff9d..06a9e6ec 100644
+--- a/mt7603/dma.c
++++ b/mt7603/dma.c
+@@ -69,7 +69,7 @@ free:
+ }
+
+ void mt7603_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+- struct sk_buff *skb)
++ struct sk_buff *skb, u32 *info)
+ {
+ struct mt7603_dev *dev = container_of(mdev, struct mt7603_dev, mt76);
+ __le32 *rxd = (__le32 *)skb->data;
+diff --git a/mt7603/mt7603.h b/mt7603/mt7603.h
+index 0fd46d90..7c3be596 100644
+--- a/mt7603/mt7603.h
++++ b/mt7603/mt7603.h
+@@ -244,7 +244,7 @@ int mt7603_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ void mt7603_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e);
+
+ void mt7603_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+- struct sk_buff *skb);
++ struct sk_buff *skb, u32 *info);
+ void mt7603_rx_poll_complete(struct mt76_dev *mdev, enum mt76_rxq_id q);
+ void mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
+ int mt7603_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+diff --git a/mt7615/mac.c b/mt7615/mac.c
+index 305bf182..a9560247 100644
+--- a/mt7615/mac.c
++++ b/mt7615/mac.c
+@@ -1666,7 +1666,7 @@ bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len)
+ EXPORT_SYMBOL_GPL(mt7615_rx_check);
+
+ void mt7615_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+- struct sk_buff *skb)
++ struct sk_buff *skb, u32 *info)
+ {
+ struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
+ __le32 *rxd = (__le32 *)skb->data;
+diff --git a/mt7615/mt7615.h b/mt7615/mt7615.h
+index 1080d202..43739ecf 100644
+--- a/mt7615/mt7615.h
++++ b/mt7615/mt7615.h
+@@ -514,7 +514,7 @@ void mt7615_tx_worker(struct mt76_worker *w);
+ void mt7615_tx_token_put(struct mt7615_dev *dev);
+ bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len);
+ void mt7615_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+- struct sk_buff *skb);
++ struct sk_buff *skb, u32 *info);
+ void mt7615_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
+ int mt7615_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta);
+diff --git a/mt76_connac.h b/mt76_connac.h
+index 0915eb57..8ba883b0 100644
+--- a/mt76_connac.h
++++ b/mt76_connac.h
+@@ -187,6 +187,11 @@ static inline bool is_mt7986(struct mt76_dev *dev)
+ return mt76_chip(dev) == 0x7986;
+ }
+
++static inline bool is_mt7996(struct mt76_dev *dev)
++{
++ return mt76_chip(dev) == 0x7990;
++}
++
+ static inline bool is_mt7622(struct mt76_dev *dev)
+ {
+ if (!IS_ENABLED(CONFIG_MT7622_WMAC))
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index dfec416e..c65267b4 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -65,7 +65,8 @@ int mt76_connac_mcu_init_download(struct mt76_dev *dev, u32 addr, u32 len,
+ int cmd;
+
+ if ((!is_connac_v1(dev) && addr == MCU_PATCH_ADDRESS) ||
+- (is_mt7921(dev) && addr == 0x900000))
++ (is_mt7921(dev) && addr == 0x900000) ||
++ (is_mt7996(dev) && addr == 0x900000))
+ cmd = MCU_CMD(PATCH_START_REQ);
+ else
+ cmd = MCU_CMD(TARGET_ADDRESS_LEN_REQ);
+@@ -1183,6 +1184,16 @@ void mt76_connac_mcu_sta_ba_tlv(struct sk_buff *skb,
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba_tlv);
+
++int mt76_connac_mcu_sta_wed_update(struct mt76_dev *dev, struct sk_buff *skb)
++{
++ if (!mtk_wed_device_active(&dev->mmio.wed))
++ return 0;
++
++ return mtk_wed_device_update_msg(&dev->mmio.wed, WED_WO_STA_REC,
++ skb->data, skb->len);
++}
++EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_wed_update);
++
+ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
+ struct ieee80211_ampdu_params *params,
+ int cmd, bool enable, bool tx)
+@@ -1208,6 +1219,10 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
+ mt76_connac_mcu_wtbl_ba_tlv(dev, skb, params, enable, tx, sta_wtbl,
+ wtbl_hdr);
+
++ ret = mt76_connac_mcu_sta_wed_update(dev, skb);
++ if (ret)
++ return ret;
++
+ ret = mt76_mcu_skb_send_msg(dev, skb, cmd, true);
+ if (ret)
+ return ret;
+@@ -1218,6 +1233,10 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
+
+ mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
+
++ ret = mt76_connac_mcu_sta_wed_update(dev, skb);
++ if (ret)
++ return ret;
++
+ return mt76_mcu_skb_send_msg(dev, skb, cmd, true);
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba);
+@@ -2658,6 +2677,10 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+ if (ret)
+ return ret;
+
++ ret = mt76_connac_mcu_sta_wed_update(dev, skb);
++ if (ret)
++ return ret;
++
+ return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 87c65d25..72d235a1 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -63,7 +63,7 @@ struct mt76_connac2_mcu_txd {
+ } __packed __aligned(4);
+
+ /**
+- * struct mt76_connac2_mcu_uni_txd - mcu command descriptor for firmware v3
++ * struct mt76_connac2_mcu_uni_txd - mcu command descriptor for connac2 and connac3
+ * @txd: hardware descriptor
+ * @len: total length not including txd
+ * @cid: command identifier
+@@ -393,7 +393,8 @@ struct sta_rec_phy {
+ u8 ampdu;
+ u8 rts_policy;
+ u8 rcpi;
+- u8 rsv[2];
++ u8 max_ampdu_len; /* connac3 */
++ u8 rsv[1];
+ } __packed;
+
+ struct sta_rec_he_6g_capa {
+@@ -454,8 +455,8 @@ struct sta_rec_bf {
+ u8 ibf_dbw;
+ u8 ibf_ncol;
+ u8 ibf_nrow;
+- u8 nrow_bw160;
+- u8 ncol_bw160;
++ u8 nrow_gt_bw80;
++ u8 ncol_gt_bw80;
+ u8 ru_start_idx;
+ u8 ru_end_idx;
+
+@@ -781,6 +782,8 @@ enum {
+ STA_REC_BFEE,
+ STA_REC_PHY = 0x15,
+ STA_REC_HE_6G = 0x17,
++ STA_REC_HDRT = 0x28,
++ STA_REC_HDR_TRANS = 0x2B,
+ STA_REC_MAX_NUM
+ };
+
+@@ -986,6 +989,17 @@ enum {
+ MCU_EXT_EVENT_MURU_CTRL = 0x9f,
+ };
+
++/* unified event table */
++enum {
++ MCU_UNI_EVENT_RESULT = 0x01,
++ MCU_UNI_EVENT_FW_LOG_2_HOST = 0x04,
++ MCU_UNI_EVENT_IE_COUNTDOWN = 0x09,
++ MCU_UNI_EVENT_RDD_REPORT = 0x11,
++};
++
++#define MCU_UNI_CMD_EVENT BIT(1)
++#define MCU_UNI_CMD_UNSOLICITED_EVENT BIT(2)
++
+ enum {
+ MCU_Q_QUERY,
+ MCU_Q_SET,
+@@ -1068,10 +1082,11 @@ enum {
+
+ #define MCU_CMD_ACK BIT(0)
+ #define MCU_CMD_UNI BIT(1)
+-#define MCU_CMD_QUERY BIT(2)
++#define MCU_CMD_SET BIT(2)
+
+ #define MCU_CMD_UNI_EXT_ACK (MCU_CMD_ACK | MCU_CMD_UNI | \
+- MCU_CMD_QUERY)
++ MCU_CMD_SET)
++#define MCU_CMD_UNI_QUERY_ACK (MCU_CMD_ACK | MCU_CMD_UNI)
+
+ #define __MCU_CMD_FIELD_ID GENMASK(7, 0)
+ #define __MCU_CMD_FIELD_EXT_ID GENMASK(15, 8)
+@@ -1079,6 +1094,7 @@ enum {
+ #define __MCU_CMD_FIELD_UNI BIT(17)
+ #define __MCU_CMD_FIELD_CE BIT(18)
+ #define __MCU_CMD_FIELD_WA BIT(19)
++#define __MCU_CMD_FIELD_WM BIT(20)
+
+ #define MCU_CMD(_t) FIELD_PREP(__MCU_CMD_FIELD_ID, \
+ MCU_CMD_##_t)
+@@ -1100,6 +1116,16 @@ enum {
+ FIELD_PREP(__MCU_CMD_FIELD_EXT_ID, \
+ MCU_WA_PARAM_CMD_##_t))
+
++#define MCU_WM_UNI_CMD(_t) (MCU_UNI_CMD(_t) | \
++ __MCU_CMD_FIELD_WM)
++#define MCU_WM_UNI_CMD_QUERY(_t) (MCU_UNI_CMD(_t) | \
++ __MCU_CMD_FIELD_QUERY | \
++ __MCU_CMD_FIELD_WM)
++#define MCU_WA_UNI_CMD(_t) (MCU_UNI_CMD(_t) | \
++ __MCU_CMD_FIELD_WA)
++#define MCU_WMWA_UNI_CMD(_t) (MCU_WM_UNI_CMD(_t) | \
++ __MCU_CMD_FIELD_WA)
++
+ enum {
+ MCU_EXT_CMD_EFUSE_ACCESS = 0x01,
+ MCU_EXT_CMD_RF_REG_ACCESS = 0x02,
+@@ -1153,11 +1179,33 @@ enum {
+ MCU_UNI_CMD_DEV_INFO_UPDATE = 0x01,
+ MCU_UNI_CMD_BSS_INFO_UPDATE = 0x02,
+ MCU_UNI_CMD_STA_REC_UPDATE = 0x03,
++ MCU_UNI_CMD_EDCA_UPDATE = 0x04,
+ MCU_UNI_CMD_SUSPEND = 0x05,
+ MCU_UNI_CMD_OFFLOAD = 0x06,
+ MCU_UNI_CMD_HIF_CTRL = 0x07,
++ MCU_UNI_CMD_BAND_CONFIG = 0x08,
++ MCU_UNI_CMD_REPT_MUAR = 0x09,
++ MCU_UNI_CMD_WSYS_CONFIG = 0x0b,
++ MCU_UNI_CMD_REG_ACCESS = 0x0d,
++ MCU_UNI_CMD_POWER_CREL = 0x0f,
++ MCU_UNI_CMD_RX_HDR_TRANS = 0x12,
++ MCU_UNI_CMD_SER = 0x13,
++ MCU_UNI_CMD_TWT = 0x14,
++ MCU_UNI_CMD_RDD_CTRL = 0x19,
++ MCU_UNI_CMD_GET_MIB_INFO = 0x22,
+ MCU_UNI_CMD_SNIFFER = 0x24,
++ MCU_UNI_CMD_SR = 0x25,
+ MCU_UNI_CMD_ROC = 0x27,
++ MCU_UNI_CMD_TXPOWER = 0x2b,
++ MCU_UNI_CMD_EFUSE_CTRL = 0x2d,
++ MCU_UNI_CMD_RA = 0x2f,
++ MCU_UNI_CMD_MURU = 0x31,
++ MCU_UNI_CMD_BF = 0x33,
++ MCU_UNI_CMD_CHANNEL_SWITCH = 0x34,
++ MCU_UNI_CMD_THERMAL = 0x35,
++ MCU_UNI_CMD_VOW = 0x37,
++ MCU_UNI_CMD_RRO = 0x57,
++ MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
+ };
+
+ enum {
+@@ -1207,14 +1255,23 @@ enum {
+
+ enum {
+ UNI_BSS_INFO_BASIC = 0,
++ UNI_BSS_INFO_RA = 1,
+ UNI_BSS_INFO_RLM = 2,
+ UNI_BSS_INFO_BSS_COLOR = 4,
+ UNI_BSS_INFO_HE_BASIC = 5,
+ UNI_BSS_INFO_BCN_CONTENT = 7,
++ UNI_BSS_INFO_BCN_CSA = 8,
++ UNI_BSS_INFO_BCN_BCC = 9,
++ UNI_BSS_INFO_BCN_MBSSID = 10,
++ UNI_BSS_INFO_RATE = 11,
+ UNI_BSS_INFO_QBSS = 15,
++ UNI_BSS_INFO_SEC = 16,
++ UNI_BSS_INFO_TXCMD = 18,
+ UNI_BSS_INFO_UAPSD = 19,
+ UNI_BSS_INFO_PS = 21,
+ UNI_BSS_INFO_BCNFT = 22,
++ UNI_BSS_INFO_OFFLOAD = 25,
++ UNI_BSS_INFO_MLD = 26,
+ };
+
+ enum {
+@@ -1823,6 +1880,7 @@ int mt76_connac_mcu_set_pm(struct mt76_dev *dev, int band, int enter);
+ int mt76_connac_mcu_restart(struct mt76_dev *dev);
+ int mt76_connac_mcu_rdd_cmd(struct mt76_dev *dev, int cmd, u8 index,
+ u8 rx_sel, u8 val);
++int mt76_connac_mcu_sta_wed_update(struct mt76_dev *dev, struct sk_buff *skb);
+ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+ const char *fw_wa);
+ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name);
+diff --git a/mt76x02.h b/mt76x02.h
+index 849c2644..3f2a9b7f 100644
+--- a/mt76x02.h
++++ b/mt76x02.h
+@@ -187,7 +187,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
+ void mt76x02_remove_hdr_pad(struct sk_buff *skb, int len);
+ bool mt76x02_tx_status_data(struct mt76_dev *mdev, u8 *update);
+ void mt76x02_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+- struct sk_buff *skb);
++ struct sk_buff *skb, u32 *info);
+ void mt76x02_rx_poll_complete(struct mt76_dev *mdev, enum mt76_rxq_id q);
+ irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance);
+ void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
+diff --git a/mt76x02_txrx.c b/mt76x02_txrx.c
+index 3a313075..d8bc4ae1 100644
+--- a/mt76x02_txrx.c
++++ b/mt76x02_txrx.c
+@@ -33,7 +33,7 @@ void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
+ EXPORT_SYMBOL_GPL(mt76x02_tx);
+
+ void mt76x02_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+- struct sk_buff *skb)
++ struct sk_buff *skb, u32 *info)
+ {
+ struct mt76x02_dev *dev = container_of(mdev, struct mt76x02_dev, mt76);
+ void *rxwi = skb->data;
+diff --git a/mt7915/coredump.c b/mt7915/coredump.c
+index bb4b7040..d097a56d 100644
+--- a/mt7915/coredump.c
++++ b/mt7915/coredump.c
+@@ -9,6 +9,7 @@
+
+ static bool coredump_memdump;
+ module_param(coredump_memdump, bool, 0644);
++MODULE_PARM_DESC(coredump_memdump, "Optional ability to dump firmware memory");
+
+ static const struct mt7915_mem_region mt7915_mem_regions[] = {
+ {
+diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
+index 766e6208..30f8f18b 100644
+--- a/mt7915/debugfs.c
++++ b/mt7915/debugfs.c
+@@ -51,7 +51,7 @@ mt7915_sys_recovery_set(struct file *file, const char __user *user_buf,
+ {
+ struct mt7915_phy *phy = file->private_data;
+ struct mt7915_dev *dev = phy->dev;
+- bool ext_phy = phy != &dev->phy;
++ bool band = phy->band_idx;
+ char buf[16];
+ int ret = 0;
+ u16 val;
+@@ -83,7 +83,7 @@ mt7915_sys_recovery_set(struct file *file, const char __user *user_buf,
+ * 8: trigger firmware crash.
+ */
+ case SER_QUERY:
+- ret = mt7915_mcu_set_ser(dev, 0, 0, ext_phy);
++ ret = mt7915_mcu_set_ser(dev, 0, 0, band);
+ break;
+ case SER_SET_RECOVER_L1:
+ case SER_SET_RECOVER_L2:
+@@ -91,17 +91,17 @@ mt7915_sys_recovery_set(struct file *file, const char __user *user_buf,
+ case SER_SET_RECOVER_L3_TX_ABORT:
+ case SER_SET_RECOVER_L3_TX_DISABLE:
+ case SER_SET_RECOVER_L3_BF:
+- ret = mt7915_mcu_set_ser(dev, SER_ENABLE, BIT(val), ext_phy);
++ ret = mt7915_mcu_set_ser(dev, SER_ENABLE, BIT(val), band);
+ if (ret)
+ return ret;
+
+- ret = mt7915_mcu_set_ser(dev, SER_RECOVER, val, ext_phy);
++ ret = mt7915_mcu_set_ser(dev, SER_RECOVER, val, band);
+ break;
+
+ /* enable full chip reset */
+ case SER_SET_RECOVER_FULL:
+ mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, MT_MCU_CMD_WDT_MASK);
+- ret = mt7915_mcu_set_ser(dev, 1, 3, ext_phy);
++ ret = mt7915_mcu_set_ser(dev, 1, 3, band);
+ if (ret)
+ return ret;
+
+@@ -967,11 +967,18 @@ mt7915_rate_txpower_show(struct seq_file *file, void *data)
+ "RU484/SU40", "RU996/SU80", "RU2x996/SU160"
+ };
+ struct mt7915_phy *phy = file->private;
++ struct mt7915_dev *dev = phy->dev;
+ s8 txpower[MT7915_SKU_RATE_NUM], *buf;
+- int i;
++ u32 reg;
++ int i, ret;
++
++ ret = mt7915_mcu_get_txpower_sku(phy, txpower, sizeof(txpower));
++ if (ret)
++ return ret;
++
++ /* Txpower propagation path: TMAC -> TXV -> BBP */
++ seq_printf(file, "\nPhy %d\n", phy != &dev->phy);
+
+- seq_printf(file, "\nBand %d\n", phy != &phy->dev->phy);
+- mt7915_mcu_get_txpower_sku(phy, txpower, sizeof(txpower));
+ for (i = 0, buf = txpower; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
+ u8 mcs_num = mt7915_sku_group_len[i];
+
+@@ -982,6 +989,12 @@ mt7915_rate_txpower_show(struct seq_file *file, void *data)
+ buf += mt7915_sku_group_len[i];
+ }
+
++ reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_TPC_CTRL_STAT(phy->band_idx) :
++ MT_WF_PHY_TPC_CTRL_STAT_MT7916(phy->band_idx);
++
++ seq_printf(file, "\nBaseband transmit power %ld\n",
++ mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER));
++
+ return 0;
+ }
+
+diff --git a/mt7915/dma.c b/mt7915/dma.c
+index 9a57ad8f..27b67800 100644
+--- a/mt7915/dma.c
++++ b/mt7915/dma.c
+@@ -361,11 +361,18 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
+
+ if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
+ u32 wed_irq_mask = irq_mask;
++ int ret;
+
+ wed_irq_mask |= MT_INT_TX_DONE_BAND0 | MT_INT_TX_DONE_BAND1;
+ if (!is_mt7986(&dev->mt76))
+ mt76_wr(dev, MT_INT_WED_MASK_CSR, wed_irq_mask);
+- mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
++ else
++ mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
++
++ ret = mt7915_mcu_wed_enable_rx_stats(dev);
++ if (ret)
++ return ret;
++
+ mtk_wed_device_start(&dev->mt76.mmio.wed, wed_irq_mask);
+ }
+
+@@ -401,6 +408,9 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+ FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
+ FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1,
+ wed_control_rx1));
++ if (is_mt7915(mdev))
++ mt76_rmw(dev, MT_WFDMA0_EXT0_CFG, MT_WFDMA0_EXT0_RXWB_KEEP,
++ MT_WFDMA0_EXT0_RXWB_KEEP);
+ }
+ } else {
+ mt76_clear(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
+@@ -473,6 +483,13 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+
+ /* rx data queue for band0 */
+ if (!dev->phy.band_idx) {
++ if (mtk_wed_device_active(&mdev->mmio.wed) &&
++ mtk_wed_get_rx_capa(&mdev->mmio.wed)) {
++ dev->mt76.q_rx[MT_RXQ_MAIN].flags =
++ MT_WED_Q_RX(MT7915_RXQ_BAND0);
++ dev->mt76.rx_token_size += MT7915_RX_RING_SIZE;
++ }
++
+ ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MAIN],
+ MT_RXQ_ID(MT_RXQ_MAIN),
+ MT7915_RX_RING_SIZE,
+@@ -503,6 +520,13 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+ }
+
+ if (dev->dbdc_support || dev->phy.band_idx) {
++ if (mtk_wed_device_active(&mdev->mmio.wed) &&
++ mtk_wed_get_rx_capa(&mdev->mmio.wed)) {
++ dev->mt76.q_rx[MT_RXQ_BAND1].flags =
++ MT_WED_Q_RX(MT7915_RXQ_BAND1);
++ dev->mt76.rx_token_size += MT7915_RX_RING_SIZE;
++ }
++
+ /* rx data queue for band1 */
+ ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND1],
+ MT_RXQ_ID(MT_RXQ_BAND1),
+diff --git a/mt7915/init.c b/mt7915/init.c
+index 0a5f7d85..9e69ab82 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -355,6 +355,9 @@ mt7915_init_wiphy(struct ieee80211_hw *hw)
+ wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_DISCOVERY);
+ wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
+
++ if (!is_mt7915(&dev->mt76))
++ wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_STA_TX_PWR);
++
+ if (!mdev->dev->of_node ||
+ !of_property_read_bool(mdev->dev->of_node,
+ "mediatek,disable-radar-background"))
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 99123e77..97a19bdb 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -165,9 +165,9 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
+ sta = container_of((void *)msta, struct ieee80211_sta,
+ drv_priv);
+ for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+- u8 q = mt76_connac_lmac_mapping(i);
+- u32 tx_cur = tx_time[q];
+- u32 rx_cur = rx_time[q];
++ u8 queue = mt76_connac_lmac_mapping(i);
++ u32 tx_cur = tx_time[queue];
++ u32 rx_cur = rx_time[queue];
+ u8 tid = ac_to_tid[i];
+
+ if (!tx_cur && !rx_cur)
+@@ -245,8 +245,38 @@ void mt7915_mac_enable_rtscts(struct mt7915_dev *dev,
+ mt76_clear(dev, addr, BIT(5));
+ }
+
++static void
++mt7915_wed_check_ppe(struct mt7915_dev *dev, struct mt76_queue *q,
++ struct mt7915_sta *msta, struct sk_buff *skb,
++ u32 info)
++{
++ struct ieee80211_vif *vif;
++ struct wireless_dev *wdev;
++ u32 hash, reason;
++
++ if (!msta || !msta->vif)
++ return;
++
++ if (!(q->flags & MT_QFLAG_WED) ||
++ FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) != MT76_WED_Q_RX)
++ return;
++
++ if (!(info & MT_DMA_INFO_PPE_VLD))
++ return;
++
++ vif = container_of((void *)msta->vif, struct ieee80211_vif,
++ drv_priv);
++ wdev = ieee80211_vif_to_wdev(vif);
++ skb->dev = wdev->netdev;
++
++ reason = FIELD_GET(MT_DMA_PPE_CPU_REASON, info);
++ hash = FIELD_GET(MT_DMA_PPE_ENTRY, info);
++ mtk_wed_device_ppe_check(&dev->mt76.mmio.wed, skb, reason, hash);
++}
++
+ static int
+-mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
++mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
++ enum mt76_rxq_id q, u32 *info)
+ {
+ struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
+ struct mt76_phy *mphy = &dev->mt76.phy;
+@@ -513,6 +543,8 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
+ }
+ } else {
+ status->flag |= RX_FLAG_8023;
++ mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
++ *info);
+ }
+
+ if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
+@@ -1096,7 +1128,7 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
+ }
+
+ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+- struct sk_buff *skb)
++ struct sk_buff *skb, u32 *info)
+ {
+ struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
+ __le32 *rxd = (__le32 *)skb->data;
+@@ -1130,7 +1162,7 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+ dev_kfree_skb(skb);
+ break;
+ case PKT_TYPE_NORMAL:
+- if (!mt7915_mac_fill_rx(dev, skb)) {
++ if (!mt7915_mac_fill_rx(dev, skb, q, info)) {
+ mt76_rx(&dev->mt76, q, skb);
+ return;
+ }
+@@ -1228,18 +1260,18 @@ void mt7915_mac_set_timing(struct mt7915_phy *phy)
+ MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
+ }
+
+-void mt7915_mac_enable_nf(struct mt7915_dev *dev, bool ext_phy)
++void mt7915_mac_enable_nf(struct mt7915_dev *dev, bool band)
+ {
+ u32 reg;
+
+- reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_RXTD12(ext_phy) :
+- MT_WF_PHY_RXTD12_MT7916(ext_phy);
++ reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_RXTD12(band) :
++ MT_WF_PHY_RXTD12_MT7916(band);
+ mt76_set(dev, reg,
+ MT_WF_PHY_RXTD12_IRPI_SW_CLR_ONLY |
+ MT_WF_PHY_RXTD12_IRPI_SW_CLR);
+
+- reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_RX_CTRL1(ext_phy) :
+- MT_WF_PHY_RX_CTRL1_MT7916(ext_phy);
++ reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_RX_CTRL1(band) :
++ MT_WF_PHY_RX_CTRL1_MT7916(band);
+ mt76_set(dev, reg, FIELD_PREP(MT_WF_PHY_RX_CTRL1_IPI_EN, 0x5));
+ }
+
+@@ -1354,7 +1386,6 @@ mt7915_mac_restart(struct mt7915_dev *dev)
+ struct mt76_phy *ext_phy;
+ struct mt76_dev *mdev = &dev->mt76;
+ int i, ret;
+- u32 irq_mask;
+
+ ext_phy = dev->mt76.phys[MT_BAND1];
+ phy2 = ext_phy ? ext_phy->priv : NULL;
+@@ -1412,7 +1443,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
+ mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
+
+ if (dev->hif2) {
+- mt76_wr(dev, MT_INT1_MASK_CSR, irq_mask);
++ mt76_wr(dev, MT_INT1_MASK_CSR, dev->mt76.mmio.irqmask);
+ mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
+ }
+ if (dev_is_pci(mdev->dev)) {
+@@ -1949,7 +1980,6 @@ void mt7915_mac_update_stats(struct mt7915_phy *phy)
+ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+ {
+ struct mt7915_dev *dev = phy->dev;
+- bool ext_phy = phy != &dev->phy;
+ u32 trb;
+
+ if (!phy->omac_mask)
+@@ -1967,7 +1997,7 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+ FIELD_GET(MT_TRB_RXPSR0_RX_WTBL_PTR, phy->trb_ts)) &&
+ trb == phy->trb_ts)
+ mt7915_mcu_set_ser(dev, SER_RECOVER, SER_SET_RECOVER_L3_RX_ABORT,
+- ext_phy);
++ phy->band_idx);
+
+ phy->trb_ts = trb;
+ }
+diff --git a/mt7915/main.c b/mt7915/main.c
+index fe5ec166..2505fa7e 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -30,31 +30,31 @@ int mt7915_run(struct ieee80211_hw *hw)
+ running = mt7915_dev_running(dev);
+
+ if (!running) {
+- ret = mt76_connac_mcu_set_pm(&dev->mt76, 0, 0);
++ ret = mt76_connac_mcu_set_pm(&dev->mt76, dev->phy.band_idx, 0);
+ if (ret)
+ goto out;
+
+- ret = mt7915_mcu_set_mac(dev, 0, true, true);
++ ret = mt7915_mcu_set_mac(dev, dev->phy.band_idx, true, true);
+ if (ret)
+ goto out;
+
+- mt7915_mac_enable_nf(dev, 0);
++ mt7915_mac_enable_nf(dev, dev->phy.band_idx);
+ }
+
+- if (phy != &dev->phy || phy->band_idx) {
+- ret = mt76_connac_mcu_set_pm(&dev->mt76, 1, 0);
++ if (phy != &dev->phy) {
++ ret = mt76_connac_mcu_set_pm(&dev->mt76, phy->band_idx, 0);
+ if (ret)
+ goto out;
+
+- ret = mt7915_mcu_set_mac(dev, 1, true, true);
++ ret = mt7915_mcu_set_mac(dev, phy->band_idx, true, true);
+ if (ret)
+ goto out;
+
+- mt7915_mac_enable_nf(dev, 1);
++ mt7915_mac_enable_nf(dev, phy->band_idx);
+ }
+
+ ret = mt76_connac_mcu_set_rts_thresh(&dev->mt76, 0x92b,
+- phy != &dev->phy);
++ phy->band_idx);
+ if (ret)
+ goto out;
+
+@@ -107,13 +107,13 @@ static void mt7915_stop(struct ieee80211_hw *hw)
+ clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
+
+ if (phy != &dev->phy) {
+- mt76_connac_mcu_set_pm(&dev->mt76, 1, 1);
+- mt7915_mcu_set_mac(dev, 1, false, false);
++ mt76_connac_mcu_set_pm(&dev->mt76, phy->band_idx, 1);
++ mt7915_mcu_set_mac(dev, phy->band_idx, false, false);
+ }
+
+ if (!mt7915_dev_running(dev)) {
+- mt76_connac_mcu_set_pm(&dev->mt76, 0, 1);
+- mt7915_mcu_set_mac(dev, 0, false, false);
++ mt76_connac_mcu_set_pm(&dev->mt76, dev->phy.band_idx, 1);
++ mt7915_mcu_set_mac(dev, dev->phy.band_idx, false, false);
+ }
+
+ mutex_unlock(&dev->mt76.mutex);
+@@ -440,7 +440,6 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+ {
+ struct mt7915_dev *dev = mt7915_hw_dev(hw);
+ struct mt7915_phy *phy = mt7915_hw_phy(hw);
+- bool band = phy != &dev->phy;
+ int ret;
+
+ if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+@@ -468,6 +467,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+
+ if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
+ bool enabled = !!(hw->conf.flags & IEEE80211_CONF_MONITOR);
++ bool band = phy->band_idx;
+
+ if (!enabled)
+ phy->rxfilter |= MT_WF_RFCR_DROP_OTHER_UC;
+@@ -505,7 +505,7 @@ static void mt7915_configure_filter(struct ieee80211_hw *hw,
+ {
+ struct mt7915_dev *dev = mt7915_hw_dev(hw);
+ struct mt7915_phy *phy = mt7915_hw_phy(hw);
+- bool band = phy != &dev->phy;
++ bool band = phy->band_idx;
+ u32 ctl_flags = MT_WF_RFCR1_DROP_ACK |
+ MT_WF_RFCR1_DROP_BF_POLL |
+ MT_WF_RFCR1_DROP_BA |
+@@ -600,10 +600,8 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+ mt7915_mcu_add_sta(dev, vif, NULL, join);
+ }
+
+- if (changed & BSS_CHANGED_ASSOC) {
++ if (changed & BSS_CHANGED_ASSOC)
+ mt7915_mcu_add_bss_info(phy, vif, info->assoc);
+- mt7915_mcu_add_obss_spr(dev, vif, info->he_obss_pd.enable);
+- }
+
+ if (changed & BSS_CHANGED_ERP_CTS_PROT)
+ mt7915_mac_enable_rtscts(dev, vif, info->use_cts_prot);
+@@ -627,7 +625,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+ mt7915_mcu_set_tx(dev, vif);
+
+ if (changed & BSS_CHANGED_HE_OBSS_PD)
+- mt7915_mcu_add_obss_spr(dev, vif, info->he_obss_pd.enable);
++ mt7915_mcu_add_obss_spr(phy, vif, &info->he_obss_pd);
+
+ if (changed & BSS_CHANGED_HE_BSS_COLOR)
+ mt7915_update_bss_color(hw, vif, &info->he_bss_color);
+@@ -744,7 +742,7 @@ static int mt7915_set_rts_threshold(struct ieee80211_hw *hw, u32 val)
+ int ret;
+
+ mutex_lock(&dev->mt76.mutex);
+- ret = mt76_connac_mcu_set_rts_thresh(&dev->mt76, val, phy != &dev->phy);
++ ret = mt76_connac_mcu_set_rts_thresh(&dev->mt76, val, phy->band_idx);
+ mutex_unlock(&dev->mt76.mutex);
+
+ return ret;
+@@ -847,7 +845,7 @@ u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif)
+ {
+ struct mt7915_dev *dev = mt7915_hw_dev(hw);
+ struct mt7915_phy *phy = mt7915_hw_phy(hw);
+- bool band = phy != &dev->phy;
++ bool band = phy->band_idx;
+ union {
+ u64 t64;
+ u32 t32[2];
+@@ -892,7 +890,7 @@ mt7915_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+ struct mt7915_dev *dev = mt7915_hw_dev(hw);
+ struct mt7915_phy *phy = mt7915_hw_phy(hw);
+- bool band = phy != &dev->phy;
++ bool band = phy->band_idx;
+ union {
+ u64 t64;
+ u32 t32[2];
+@@ -923,7 +921,7 @@ mt7915_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+ struct mt7915_dev *dev = mt7915_hw_dev(hw);
+ struct mt7915_phy *phy = mt7915_hw_phy(hw);
+- bool band = phy != &dev->phy;
++ bool band = phy->band_idx;
+ union {
+ u64 t64;
+ u32 t32[2];
+@@ -1036,6 +1034,14 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+
+ sinfo->tx_retries = msta->wcid.stats.tx_retries;
+ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
++
++ if (mtk_wed_get_rx_capa(&phy->dev->mt76.mmio.wed)) {
++ sinfo->rx_bytes = msta->wcid.stats.rx_bytes;
++ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
++
++ sinfo->rx_packets = msta->wcid.stats.rx_packets;
++ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
++ }
+ }
+
+ sinfo->ack_signal = (s8)msta->ack_signal;
+@@ -1127,6 +1133,39 @@ static void mt7915_sta_set_decap_offload(struct ieee80211_hw *hw,
+ mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
+ }
+
++static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
++ struct ieee80211_vif *vif,
++ struct ieee80211_sta *sta)
++{
++ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct mt7915_dev *dev = mt7915_hw_dev(hw);
++ s16 txpower = sta->txpwr.power;
++ int ret;
++
++ if (sta->txpwr.type == NL80211_TX_POWER_AUTOMATIC)
++ txpower = 0;
++
++ mutex_lock(&dev->mt76.mutex);
++
++ /* NOTE: temporarily use 0 as minimum limit, which is a
++ * global setting and will be applied to all stations.
++ */
++ ret = mt7915_mcu_set_txpower_frame_min(phy, 0);
++ if (ret)
++ goto out;
++
++ /* This only applies to data frames while pushing traffic,
++ * whereas the management frames or other packets that are
++ * using fixed rate can be configured via TxD.
++ */
++ ret = mt7915_mcu_set_txpower_frame(phy, vif, sta, txpower);
++
++out:
++ mutex_unlock(&dev->mt76.mutex);
++
++ return ret;
++}
++
+ static const char mt7915_gstrings_stats[][ETH_GSTRING_LEN] = {
+ "tx_ampdu_cnt",
+ "tx_stop_q_empty_cnt",
+@@ -1492,6 +1531,7 @@ const struct ieee80211_ops mt7915_ops = {
+ .set_bitrate_mask = mt7915_set_bitrate_mask,
+ .set_coverage_class = mt7915_set_coverage_class,
+ .sta_statistics = mt7915_sta_statistics,
++ .sta_set_txpwr = mt7915_sta_set_txpwr,
+ .sta_set_4addr = mt7915_sta_set_4addr,
+ .sta_set_decap_offload = mt7915_sta_set_decap_offload,
+ .add_twt_setup = mt7915_mac_add_twt_setup,
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 09e3dd8e..36c21596 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -32,6 +32,10 @@
+ #define HE_PHY(p, c) u8_get_bits(c, IEEE80211_HE_PHY_##p)
+ #define HE_MAC(m, c) u8_get_bits(c, IEEE80211_HE_MAC_##m)
+
++static bool sr_scene_detect = true;
++module_param(sr_scene_detect, bool, 0644);
++MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
++
+ static u8
+ mt7915_mcu_get_sta_nss(u16 mcs_map)
+ {
+@@ -595,7 +599,7 @@ mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ .mode = !!mask || enable,
+ .entry_count = 1,
+ .write = 1,
+- .band = phy != &dev->phy,
++ .band = phy->band_idx,
+ .index = idx * 2 + bssid,
+ };
+
+@@ -1131,7 +1135,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+ mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
+ nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
+
+- bf->ncol_bw160 = nss_mcs;
++ bf->ncol_gt_bw80 = nss_mcs;
+ }
+
+ if (pe->phy_cap_info[0] &
+@@ -1139,10 +1143,10 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+ mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
+ nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
+
+- if (bf->ncol_bw160)
+- bf->ncol_bw160 = min_t(u8, bf->ncol_bw160, nss_mcs);
++ if (bf->ncol_gt_bw80)
++ bf->ncol_gt_bw80 = min_t(u8, bf->ncol_gt_bw80, nss_mcs);
+ else
+- bf->ncol_bw160 = nss_mcs;
++ bf->ncol_gt_bw80 = nss_mcs;
+ }
+
+ snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
+@@ -1150,7 +1154,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+ sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
+ pe->phy_cap_info[4]);
+
+- bf->nrow_bw160 = min_t(int, snd_dim, sts);
++ bf->nrow_gt_bw80 = min_t(int, snd_dim, sts);
+ }
+
+ static void
+@@ -1677,10 +1681,32 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ return ret;
+ }
+ out:
++ ret = mt76_connac_mcu_sta_wed_update(&dev->mt76, skb);
++ if (ret)
++ return ret;
++
+ return mt76_mcu_skb_send_msg(&dev->mt76, skb,
+ MCU_EXT_CMD(STA_REC_UPDATE), true);
+ }
+
++int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev)
++{
++#ifdef CONFIG_NET_MEDIATEK_SOC_WED
++ struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
++ struct {
++ __le32 args[2];
++ } req = {
++ .args[0] = cpu_to_le32(1),
++ .args[1] = cpu_to_le32(6),
++ };
++
++ return mtk_wed_device_update_msg(wed, MTK_WED_WO_CMD_RXCNT_CTRL,
++ &req, sizeof(req));
++#else
++ return 0;
++#endif
++}
++
+ int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
+ struct ieee80211_vif *vif, bool enable)
+ {
+@@ -1689,7 +1715,7 @@ int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
+ struct {
+ struct req_hdr {
+ u8 omac_idx;
+- u8 dbdc_idx;
++ u8 band_idx;
+ __le16 tlv_num;
+ u8 is_tlv_append;
+ u8 rsv[3];
+@@ -1698,13 +1724,13 @@ int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
+ __le16 tag;
+ __le16 len;
+ u8 active;
+- u8 dbdc_idx;
++ u8 band_idx;
+ u8 omac_addr[ETH_ALEN];
+ } __packed tlv;
+ } data = {
+ .hdr = {
+ .omac_idx = mvif->mt76.omac_idx,
+- .dbdc_idx = mvif->mt76.band_idx,
++ .band_idx = mvif->mt76.band_idx,
+ .tlv_num = cpu_to_le16(1),
+ .is_tlv_append = 1,
+ },
+@@ -1712,7 +1738,7 @@ int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
+ .tag = cpu_to_le16(DEV_INFO_ACTIVE),
+ .len = cpu_to_le16(sizeof(struct req_tlv)),
+ .active = enable,
+- .dbdc_idx = mvif->mt76.band_idx,
++ .band_idx = mvif->mt76.band_idx,
+ },
+ };
+
+@@ -2559,7 +2585,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
+ req.monitor_central_chan =
+ ieee80211_frequency_to_channel(chandef->center_freq1);
+ req.monitor_bw = mt76_connac_chan_bw(chandef);
+- req.band_idx = phy != &dev->phy;
++ req.band_idx = phy->band_idx;
+ req.scan_mode = 1;
+ break;
+ }
+@@ -2567,7 +2593,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
+ req.monitor_chan = chandef->chan->hw_value;
+ req.monitor_central_chan =
+ ieee80211_frequency_to_channel(chandef->center_freq1);
+- req.band_idx = phy != &dev->phy;
++ req.band_idx = phy->band_idx;
+ req.scan_mode = 2;
+ break;
+ case CH_SWITCH_BACKGROUND_SCAN_STOP:
+@@ -2971,7 +2997,7 @@ int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
+ }
+
+ for (i = 0; i < 5; i++) {
+- req[i].band = cpu_to_le32(phy != &dev->phy);
++ req[i].band = cpu_to_le32(phy->band_idx);
+ req[i].offs = cpu_to_le32(offs[i + start]);
+
+ if (!is_mt7915(&dev->mt76) && i == 3)
+@@ -3016,11 +3042,11 @@ int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
+ struct {
+ u8 ctrl_id;
+ u8 action;
+- u8 dbdc_idx;
++ u8 band_idx;
+ u8 rsv[5];
+ } req = {
+ .ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
+- .dbdc_idx = phy != &dev->phy,
++ .band_idx = phy->band_idx,
+ };
+
+ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
+@@ -3079,6 +3105,88 @@ out:
+ &req, sizeof(req), false);
+ }
+
++int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ u8 format_id;
++ u8 rsv;
++ u8 band_idx;
++ s8 txpower_min;
++ } __packed req = {
++ .format_id = TX_POWER_LIMIT_FRAME_MIN,
++ .band_idx = phy->band_idx,
++ .txpower_min = txpower * 2, /* 0.5db */
++ };
++
++ return mt76_mcu_send_msg(&dev->mt76,
++ MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
++ sizeof(req), true);
++}
++
++int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
++ struct ieee80211_vif *vif,
++ struct ieee80211_sta *sta, s8 txpower)
++{
++ struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
++ struct mt7915_dev *dev = phy->dev;
++ struct mt76_phy *mphy = phy->mt76;
++ struct {
++ u8 format_id;
++ u8 rsv[3];
++ u8 band_idx;
++ s8 txpower_max;
++ __le16 wcid;
++ s8 txpower_offs[48];
++ } __packed req = {
++ .format_id = TX_POWER_LIMIT_FRAME,
++ .band_idx = phy->band_idx,
++ .txpower_max = DIV_ROUND_UP(mphy->txpower_cur, 2),
++ .wcid = cpu_to_le16(msta->wcid.idx),
++ };
++ int ret, n_chains = hweight8(mphy->antenna_mask);
++ s8 txpower_sku[MT7915_SKU_RATE_NUM];
++
++ ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
++ if (ret)
++ return ret;
++
++ txpower = txpower * 2 - mt76_tx_power_nss_delta(n_chains);
++ if (txpower > mphy->txpower_cur || txpower < 0)
++ return -EINVAL;
++
++ if (txpower) {
++ u32 offs, len, i;
++
++ if (sta->ht_cap.ht_supported) {
++ const u8 *sku_len = mt7915_sku_group_len;
++
++ offs = sku_len[SKU_CCK] + sku_len[SKU_OFDM];
++ len = sku_len[SKU_HT_BW20] + sku_len[SKU_HT_BW40];
++
++ if (sta->vht_cap.vht_supported) {
++ offs += len;
++ len = sku_len[SKU_VHT_BW20] * 4;
++
++ if (sta->he_cap.has_he) {
++ offs += len + sku_len[SKU_HE_RU26] * 3;
++ len = sku_len[SKU_HE_RU242] * 4;
++ }
++ }
++ } else {
++ return -EINVAL;
++ }
++
++ for (i = 0; i < len; i++, offs++)
++ req.txpower_offs[i] =
++ DIV_ROUND_UP(txpower - txpower_sku[offs], 2);
++ }
++
++ return mt76_mcu_send_msg(&dev->mt76,
++ MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
++ sizeof(req), true);
++}
++
+ int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
+ {
+ struct mt7915_dev *dev = phy->dev;
+@@ -3087,11 +3195,11 @@ int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
+ struct mt7915_sku_val {
+ u8 format_id;
+ u8 limit_type;
+- u8 dbdc_idx;
++ u8 band_idx;
+ s8 val[MT7915_SKU_RATE_NUM];
+ } __packed req = {
+- .format_id = 4,
+- .dbdc_idx = phy != &dev->phy,
++ .format_id = TX_POWER_LIMIT_TABLE,
++ .band_idx = phy->band_idx,
+ };
+ struct mt76_power_limits limits_array;
+ s8 *la = (s8 *)&limits_array;
+@@ -3137,14 +3245,14 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+ struct {
+ u8 format_id;
+ u8 category;
+- u8 band;
++ u8 band_idx;
+ u8 _rsv;
+ } __packed req = {
+- .format_id = 7,
++ .format_id = TX_POWER_LIMIT_INFO,
+ .category = RATE_POWER_INFO,
+- .band = phy != &dev->phy,
++ .band_idx = phy->band_idx,
+ };
+- s8 res[MT7915_SKU_RATE_NUM][2];
++ s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
+ struct sk_buff *skb;
+ int ret, i;
+
+@@ -3154,9 +3262,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+ if (ret)
+ return ret;
+
+- memcpy(res, skb->data + 4, sizeof(res));
++ memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
+ for (i = 0; i < len; i++)
+- txpower[i] = res[i][req.band];
++ txpower[i] = txpower_sku[i][req.band_idx];
+
+ dev_kfree_skb(skb);
+
+@@ -3191,11 +3299,11 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+ struct mt7915_sku {
+ u8 format_id;
+ u8 sku_enable;
+- u8 dbdc_idx;
++ u8 band_idx;
+ u8 rsv;
+ } __packed req = {
+- .format_id = 0,
+- .dbdc_idx = phy != &dev->phy,
++ .format_id = TX_POWER_LIMIT_ENABLE,
++ .band_idx = phy->band_idx,
+ .sku_enable = enable,
+ };
+
+@@ -3270,31 +3378,193 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+ sizeof(req), true);
+ }
+
+-int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+- bool enable)
++static int
++mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct mt7915_mcu_sr_ctrl req = {
++ .action = action,
++ .argnum = 1,
++ .band_idx = phy->band_idx,
++ .val = cpu_to_le32(val),
++ };
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
++ sizeof(req), true);
++}
++
++static int
++mt7915_mcu_set_obss_spr_pd(struct mt7915_phy *phy,
++ struct ieee80211_he_obss_pd *he_obss_pd)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ struct mt7915_mcu_sr_ctrl ctrl;
++ struct {
++ u8 pd_th_non_srg;
++ u8 pd_th_srg;
++ u8 period_offs;
++ u8 rcpi_src;
++ __le16 obss_pd_min;
++ __le16 obss_pd_min_srg;
++ u8 resp_txpwr_mode;
++ u8 txpwr_restrict_mode;
++ u8 txpwr_ref;
++ u8 rsv[3];
++ } __packed param;
++ } __packed req = {
++ .ctrl = {
++ .action = SPR_SET_PARAM,
++ .argnum = 9,
++ .band_idx = phy->band_idx,
++ },
++ };
++ int ret;
++ u8 max_th = 82, non_srg_max_th = 62;
++
++ /* disable firmware dynamical PD asjustment */
++ ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_DPD, false);
++ if (ret)
++ return ret;
++
++ if (he_obss_pd->sr_ctrl &
++ IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED)
++ req.param.pd_th_non_srg = max_th;
++ else if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
++ req.param.pd_th_non_srg = max_th - he_obss_pd->non_srg_max_offset;
++ else
++ req.param.pd_th_non_srg = non_srg_max_th;
++
++ if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
++ req.param.pd_th_srg = max_th - he_obss_pd->max_offset;
++
++ req.param.obss_pd_min = 82;
++ req.param.obss_pd_min_srg = 82;
++ req.param.txpwr_restrict_mode = 2;
++ req.param.txpwr_ref = 21;
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
++ sizeof(req), true);
++}
++
++static int
++mt7915_mcu_set_obss_spr_siga(struct mt7915_phy *phy, struct ieee80211_vif *vif,
++ struct ieee80211_he_obss_pd *he_obss_pd)
+ {
+-#define MT_SPR_ENABLE 1
+ struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++ struct mt7915_dev *dev = phy->dev;
++ u8 omac = mvif->mt76.omac_idx;
+ struct {
+- u8 action;
+- u8 arg_num;
+- u8 band_idx;
+- u8 status;
+- u8 drop_tx_idx;
+- u8 sta_idx; /* 256 sta */
+- u8 rsv[2];
+- __le32 val;
++ struct mt7915_mcu_sr_ctrl ctrl;
++ struct {
++ u8 omac;
++ u8 rsv[3];
++ u8 flag[20];
++ } __packed siga;
+ } __packed req = {
+- .action = MT_SPR_ENABLE,
+- .arg_num = 1,
+- .band_idx = mvif->mt76.band_idx,
+- .val = cpu_to_le32(enable),
++ .ctrl = {
++ .action = SPR_SET_SIGA,
++ .argnum = 1,
++ .band_idx = phy->band_idx,
++ },
++ .siga = {
++ .omac = omac > HW_BSSID_MAX ? omac - 12 : omac,
++ },
+ };
++ int ret;
++
++ if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED)
++ req.siga.flag[req.siga.omac] = 0xf;
++ else
++ return 0;
++
++ /* switch to normal AP mode */
++ ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_MODE, 0);
++ if (ret)
++ return ret;
+
+ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
+ sizeof(req), true);
+ }
+
++static int
++mt7915_mcu_set_obss_spr_bitmap(struct mt7915_phy *phy,
++ struct ieee80211_he_obss_pd *he_obss_pd)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ struct mt7915_mcu_sr_ctrl ctrl;
++ struct {
++ __le32 color_l[2];
++ __le32 color_h[2];
++ __le32 bssid_l[2];
++ __le32 bssid_h[2];
++ } __packed bitmap;
++ } __packed req = {
++ .ctrl = {
++ .action = SPR_SET_SRG_BITMAP,
++ .argnum = 4,
++ .band_idx = phy->band_idx,
++ },
++ };
++ u32 bitmap;
++
++ memcpy(&bitmap, he_obss_pd->bss_color_bitmap, sizeof(bitmap));
++ req.bitmap.color_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
++
++ memcpy(&bitmap, he_obss_pd->bss_color_bitmap + 4, sizeof(bitmap));
++ req.bitmap.color_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
++
++ memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap, sizeof(bitmap));
++ req.bitmap.bssid_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
++
++ memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap + 4, sizeof(bitmap));
++ req.bitmap.bssid_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
++ sizeof(req), true);
++}
++
++int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
++ struct ieee80211_he_obss_pd *he_obss_pd)
++{
++ int ret;
++
++ /* enable firmware scene detection algorithms */
++ ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_SD, sr_scene_detect);
++ if (ret)
++ return ret;
++
++ /* enable spatial reuse */
++ ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE, he_obss_pd->enable);
++ if (ret)
++ return ret;
++
++ if (!he_obss_pd->enable)
++ return 0;
++
++ ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_TX, true);
++ if (ret)
++ return ret;
++
++ /* firmware dynamically adjusts PD threshold so skip manual control */
++ if (sr_scene_detect)
++ return 0;
++
++ /* set SRG/non-SRG OBSS PD threshold */
++ ret = mt7915_mcu_set_obss_spr_pd(phy, he_obss_pd);
++ if (ret)
++ return ret;
++
++ /* Set SR prohibit */
++ ret = mt7915_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
++ if (ret)
++ return ret;
++
++ /* set SRG BSS color/BSSID bitmap */
++ return mt7915_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
++}
++
+ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta, struct rate_info *rate)
+ {
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index c19b5d66..46c517e5 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -129,6 +129,17 @@ struct mt7915_mcu_background_chain_ctrl {
+ u8 rsv[2];
+ } __packed;
+
++struct mt7915_mcu_sr_ctrl {
++ u8 action;
++ u8 argnum;
++ u8 band_idx;
++ u8 status;
++ u8 drop_ta_idx;
++ u8 sta_idx; /* 256 sta */
++ u8 rsv[2];
++ __le32 val;
++} __packed;
++
+ struct mt7915_mcu_eeprom {
+ u8 buffer_mode;
+ u8 format;
+@@ -408,6 +419,25 @@ enum {
+ #define RATE_CFG_PHY_TYPE GENMASK(27, 24)
+ #define RATE_CFG_HE_LTF GENMASK(31, 28)
+
++enum {
++ TX_POWER_LIMIT_ENABLE,
++ TX_POWER_LIMIT_TABLE = 0x4,
++ TX_POWER_LIMIT_INFO = 0x7,
++ TX_POWER_LIMIT_FRAME = 0x11,
++ TX_POWER_LIMIT_FRAME_MIN = 0x12,
++};
++
++enum {
++ SPR_ENABLE = 0x1,
++ SPR_ENABLE_SD = 0x3,
++ SPR_ENABLE_MODE = 0x5,
++ SPR_ENABLE_DPD = 0x23,
++ SPR_ENABLE_TX = 0x25,
++ SPR_SET_SRG_BITMAP = 0x80,
++ SPR_SET_PARAM = 0xc2,
++ SPR_SET_SIGA = 0xdc,
++};
++
+ enum {
+ THERMAL_PROTECT_PARAMETER_CTRL,
+ THERMAL_PROTECT_BASIC_INFO,
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 3c840853..3b4ede3b 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -9,107 +9,112 @@
+ #include "mt7915.h"
+ #include "mac.h"
+ #include "../trace.h"
++#include "../dma.h"
+
+ static bool wed_enable;
+ module_param(wed_enable, bool, 0644);
++MODULE_PARM_DESC(wed_enable, "Enable Wireless Ethernet Dispatch support");
+
+ static const u32 mt7915_reg[] = {
+- [INT_SOURCE_CSR] = 0xd7010,
+- [INT_MASK_CSR] = 0xd7014,
+- [INT1_SOURCE_CSR] = 0xd7088,
+- [INT1_MASK_CSR] = 0xd708c,
+- [INT_MCU_CMD_SOURCE] = 0xd51f0,
+- [INT_MCU_CMD_EVENT] = 0x3108,
+- [WFDMA0_ADDR] = 0xd4000,
+- [WFDMA0_PCIE1_ADDR] = 0xd8000,
+- [WFDMA_EXT_CSR_ADDR] = 0xd7000,
+- [CBTOP1_PHY_END] = 0x77ffffff,
+- [INFRA_MCU_ADDR_END] = 0x7c3fffff,
+- [FW_ASSERT_STAT_ADDR] = 0x219848,
+- [FW_EXCEPT_TYPE_ADDR] = 0x21987c,
+- [FW_EXCEPT_COUNT_ADDR] = 0x219848,
+- [FW_CIRQ_COUNT_ADDR] = 0x216f94,
+- [FW_CIRQ_IDX_ADDR] = 0x216ef8,
+- [FW_CIRQ_LISR_ADDR] = 0x2170ac,
+- [FW_TASK_ID_ADDR] = 0x216f90,
+- [FW_TASK_IDX_ADDR] = 0x216f9c,
+- [FW_TASK_QID1_ADDR] = 0x219680,
+- [FW_TASK_QID2_ADDR] = 0x219760,
+- [FW_TASK_START_ADDR] = 0x219558,
+- [FW_TASK_END_ADDR] = 0x219554,
+- [FW_TASK_SIZE_ADDR] = 0x219560,
+- [FW_LAST_MSG_ID_ADDR] = 0x216f70,
+- [FW_EINT_INFO_ADDR] = 0x219818,
+- [FW_SCHED_INFO_ADDR] = 0x219828,
+- [SWDEF_BASE_ADDR] = 0x41f200,
+- [TXQ_WED_RING_BASE] = 0xd7300,
+- [RXQ_WED_RING_BASE] = 0xd7410,
++ [INT_SOURCE_CSR] = 0xd7010,
++ [INT_MASK_CSR] = 0xd7014,
++ [INT1_SOURCE_CSR] = 0xd7088,
++ [INT1_MASK_CSR] = 0xd708c,
++ [INT_MCU_CMD_SOURCE] = 0xd51f0,
++ [INT_MCU_CMD_EVENT] = 0x3108,
++ [WFDMA0_ADDR] = 0xd4000,
++ [WFDMA0_PCIE1_ADDR] = 0xd8000,
++ [WFDMA_EXT_CSR_ADDR] = 0xd7000,
++ [CBTOP1_PHY_END] = 0x77ffffff,
++ [INFRA_MCU_ADDR_END] = 0x7c3fffff,
++ [FW_ASSERT_STAT_ADDR] = 0x219848,
++ [FW_EXCEPT_TYPE_ADDR] = 0x21987c,
++ [FW_EXCEPT_COUNT_ADDR] = 0x219848,
++ [FW_CIRQ_COUNT_ADDR] = 0x216f94,
++ [FW_CIRQ_IDX_ADDR] = 0x216ef8,
++ [FW_CIRQ_LISR_ADDR] = 0x2170ac,
++ [FW_TASK_ID_ADDR] = 0x216f90,
++ [FW_TASK_IDX_ADDR] = 0x216f9c,
++ [FW_TASK_QID1_ADDR] = 0x219680,
++ [FW_TASK_QID2_ADDR] = 0x219760,
++ [FW_TASK_START_ADDR] = 0x219558,
++ [FW_TASK_END_ADDR] = 0x219554,
++ [FW_TASK_SIZE_ADDR] = 0x219560,
++ [FW_LAST_MSG_ID_ADDR] = 0x216f70,
++ [FW_EINT_INFO_ADDR] = 0x219818,
++ [FW_SCHED_INFO_ADDR] = 0x219828,
++ [SWDEF_BASE_ADDR] = 0x41f200,
++ [TXQ_WED_RING_BASE] = 0xd7300,
++ [RXQ_WED_RING_BASE] = 0xd7410,
++ [RXQ_WED_DATA_RING_BASE] = 0xd4500,
+ };
+
+ static const u32 mt7916_reg[] = {
+- [INT_SOURCE_CSR] = 0xd4200,
+- [INT_MASK_CSR] = 0xd4204,
+- [INT1_SOURCE_CSR] = 0xd8200,
+- [INT1_MASK_CSR] = 0xd8204,
+- [INT_MCU_CMD_SOURCE] = 0xd41f0,
+- [INT_MCU_CMD_EVENT] = 0x2108,
+- [WFDMA0_ADDR] = 0xd4000,
+- [WFDMA0_PCIE1_ADDR] = 0xd8000,
+- [WFDMA_EXT_CSR_ADDR] = 0xd7000,
+- [CBTOP1_PHY_END] = 0x7fffffff,
+- [INFRA_MCU_ADDR_END] = 0x7c085fff,
+- [FW_ASSERT_STAT_ADDR] = 0x02204c14,
+- [FW_EXCEPT_TYPE_ADDR] = 0x022051a4,
+- [FW_EXCEPT_COUNT_ADDR] = 0x022050bc,
+- [FW_CIRQ_COUNT_ADDR] = 0x022001ac,
+- [FW_CIRQ_IDX_ADDR] = 0x02204f84,
+- [FW_CIRQ_LISR_ADDR] = 0x022050d0,
+- [FW_TASK_ID_ADDR] = 0x0220406c,
+- [FW_TASK_IDX_ADDR] = 0x0220500c,
+- [FW_TASK_QID1_ADDR] = 0x022028c8,
+- [FW_TASK_QID2_ADDR] = 0x02202a38,
+- [FW_TASK_START_ADDR] = 0x0220286c,
+- [FW_TASK_END_ADDR] = 0x02202870,
+- [FW_TASK_SIZE_ADDR] = 0x02202878,
+- [FW_LAST_MSG_ID_ADDR] = 0x02204fe8,
+- [FW_EINT_INFO_ADDR] = 0x0220525c,
+- [FW_SCHED_INFO_ADDR] = 0x0220516c,
+- [SWDEF_BASE_ADDR] = 0x411400,
+- [TXQ_WED_RING_BASE] = 0xd7300,
+- [RXQ_WED_RING_BASE] = 0xd7410,
++ [INT_SOURCE_CSR] = 0xd4200,
++ [INT_MASK_CSR] = 0xd4204,
++ [INT1_SOURCE_CSR] = 0xd8200,
++ [INT1_MASK_CSR] = 0xd8204,
++ [INT_MCU_CMD_SOURCE] = 0xd41f0,
++ [INT_MCU_CMD_EVENT] = 0x2108,
++ [WFDMA0_ADDR] = 0xd4000,
++ [WFDMA0_PCIE1_ADDR] = 0xd8000,
++ [WFDMA_EXT_CSR_ADDR] = 0xd7000,
++ [CBTOP1_PHY_END] = 0x7fffffff,
++ [INFRA_MCU_ADDR_END] = 0x7c085fff,
++ [FW_ASSERT_STAT_ADDR] = 0x02204c14,
++ [FW_EXCEPT_TYPE_ADDR] = 0x022051a4,
++ [FW_EXCEPT_COUNT_ADDR] = 0x022050bc,
++ [FW_CIRQ_COUNT_ADDR] = 0x022001ac,
++ [FW_CIRQ_IDX_ADDR] = 0x02204f84,
++ [FW_CIRQ_LISR_ADDR] = 0x022050d0,
++ [FW_TASK_ID_ADDR] = 0x0220406c,
++ [FW_TASK_IDX_ADDR] = 0x0220500c,
++ [FW_TASK_QID1_ADDR] = 0x022028c8,
++ [FW_TASK_QID2_ADDR] = 0x02202a38,
++ [FW_TASK_START_ADDR] = 0x0220286c,
++ [FW_TASK_END_ADDR] = 0x02202870,
++ [FW_TASK_SIZE_ADDR] = 0x02202878,
++ [FW_LAST_MSG_ID_ADDR] = 0x02204fe8,
++ [FW_EINT_INFO_ADDR] = 0x0220525c,
++ [FW_SCHED_INFO_ADDR] = 0x0220516c,
++ [SWDEF_BASE_ADDR] = 0x411400,
++ [TXQ_WED_RING_BASE] = 0xd7300,
++ [RXQ_WED_RING_BASE] = 0xd7410,
++ [RXQ_WED_DATA_RING_BASE] = 0xd4540,
+ };
+
+ static const u32 mt7986_reg[] = {
+- [INT_SOURCE_CSR] = 0x24200,
+- [INT_MASK_CSR] = 0x24204,
+- [INT1_SOURCE_CSR] = 0x28200,
+- [INT1_MASK_CSR] = 0x28204,
+- [INT_MCU_CMD_SOURCE] = 0x241f0,
+- [INT_MCU_CMD_EVENT] = 0x54000108,
+- [WFDMA0_ADDR] = 0x24000,
+- [WFDMA0_PCIE1_ADDR] = 0x28000,
+- [WFDMA_EXT_CSR_ADDR] = 0x27000,
+- [CBTOP1_PHY_END] = 0x7fffffff,
+- [INFRA_MCU_ADDR_END] = 0x7c085fff,
+- [FW_ASSERT_STAT_ADDR] = 0x02204b54,
+- [FW_EXCEPT_TYPE_ADDR] = 0x022050dc,
+- [FW_EXCEPT_COUNT_ADDR] = 0x02204ffc,
+- [FW_CIRQ_COUNT_ADDR] = 0x022001ac,
+- [FW_CIRQ_IDX_ADDR] = 0x02204ec4,
+- [FW_CIRQ_LISR_ADDR] = 0x02205010,
+- [FW_TASK_ID_ADDR] = 0x02204fac,
+- [FW_TASK_IDX_ADDR] = 0x02204f4c,
+- [FW_TASK_QID1_ADDR] = 0x02202814,
+- [FW_TASK_QID2_ADDR] = 0x02202984,
+- [FW_TASK_START_ADDR] = 0x022027b8,
+- [FW_TASK_END_ADDR] = 0x022027bc,
+- [FW_TASK_SIZE_ADDR] = 0x022027c4,
+- [FW_LAST_MSG_ID_ADDR] = 0x02204f28,
+- [FW_EINT_INFO_ADDR] = 0x02205194,
+- [FW_SCHED_INFO_ADDR] = 0x022051a4,
+- [SWDEF_BASE_ADDR] = 0x411400,
+- [TXQ_WED_RING_BASE] = 0x24420,
+- [RXQ_WED_RING_BASE] = 0x24520,
++ [INT_SOURCE_CSR] = 0x24200,
++ [INT_MASK_CSR] = 0x24204,
++ [INT1_SOURCE_CSR] = 0x28200,
++ [INT1_MASK_CSR] = 0x28204,
++ [INT_MCU_CMD_SOURCE] = 0x241f0,
++ [INT_MCU_CMD_EVENT] = 0x54000108,
++ [WFDMA0_ADDR] = 0x24000,
++ [WFDMA0_PCIE1_ADDR] = 0x28000,
++ [WFDMA_EXT_CSR_ADDR] = 0x27000,
++ [CBTOP1_PHY_END] = 0x7fffffff,
++ [INFRA_MCU_ADDR_END] = 0x7c085fff,
++ [FW_ASSERT_STAT_ADDR] = 0x02204b54,
++ [FW_EXCEPT_TYPE_ADDR] = 0x022050dc,
++ [FW_EXCEPT_COUNT_ADDR] = 0x02204ffc,
++ [FW_CIRQ_COUNT_ADDR] = 0x022001ac,
++ [FW_CIRQ_IDX_ADDR] = 0x02204ec4,
++ [FW_CIRQ_LISR_ADDR] = 0x02205010,
++ [FW_TASK_ID_ADDR] = 0x02204fac,
++ [FW_TASK_IDX_ADDR] = 0x02204f4c,
++ [FW_TASK_QID1_ADDR] = 0x02202814,
++ [FW_TASK_QID2_ADDR] = 0x02202984,
++ [FW_TASK_START_ADDR] = 0x022027b8,
++ [FW_TASK_END_ADDR] = 0x022027bc,
++ [FW_TASK_SIZE_ADDR] = 0x022027c4,
++ [FW_LAST_MSG_ID_ADDR] = 0x02204f28,
++ [FW_EINT_INFO_ADDR] = 0x02205194,
++ [FW_SCHED_INFO_ADDR] = 0x022051a4,
++ [SWDEF_BASE_ADDR] = 0x411400,
++ [TXQ_WED_RING_BASE] = 0x24420,
++ [RXQ_WED_RING_BASE] = 0x24520,
++ [RXQ_WED_DATA_RING_BASE] = 0x24540,
+ };
+
+ static const u32 mt7915_offs[] = {
+@@ -585,6 +590,105 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+ mt76_clear(dev, MT_AGG_ACR4(phy->band_idx),
+ MT_AGG_ACR_PPDU_TXS2H);
+ }
++
++static void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
++{
++ struct mt7915_dev *dev;
++ struct page *page;
++ int i;
++
++ dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
++ for (i = 0; i < dev->mt76.rx_token_size; i++) {
++ struct mt76_txwi_cache *t;
++
++ t = mt76_rx_token_release(&dev->mt76, i);
++ if (!t || !t->ptr)
++ continue;
++
++ dma_unmap_single(dev->mt76.dma_dev, t->dma_addr,
++ wed->wlan.rx_size, DMA_FROM_DEVICE);
++ skb_free_frag(t->ptr);
++ t->ptr = NULL;
++
++ mt76_put_rxwi(&dev->mt76, t);
++ }
++
++ if (!wed->rx_buf_ring.rx_page.va)
++ return;
++
++ page = virt_to_page(wed->rx_buf_ring.rx_page.va);
++ __page_frag_cache_drain(page, wed->rx_buf_ring.rx_page.pagecnt_bias);
++ memset(&wed->rx_buf_ring.rx_page, 0, sizeof(wed->rx_buf_ring.rx_page));
++}
++
++static u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
++{
++ struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
++ struct mt7915_dev *dev;
++ u32 length;
++ int i;
++
++ dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
++ length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
++ sizeof(struct skb_shared_info));
++
++ for (i = 0; i < size; i++) {
++ struct mt76_txwi_cache *t = mt76_get_rxwi(&dev->mt76);
++ dma_addr_t phy_addr;
++ int token;
++ void *ptr;
++
++ ptr = page_frag_alloc(&wed->rx_buf_ring.rx_page, length,
++ GFP_KERNEL);
++ if (!ptr)
++ goto unmap;
++
++ phy_addr = dma_map_single(dev->mt76.dma_dev, ptr,
++ wed->wlan.rx_size,
++ DMA_TO_DEVICE);
++ if (unlikely(dma_mapping_error(dev->mt76.dev, phy_addr))) {
++ skb_free_frag(ptr);
++ goto unmap;
++ }
++
++ desc->buf0 = cpu_to_le32(phy_addr);
++ token = mt76_rx_token_consume(&dev->mt76, ptr, t, phy_addr);
++ desc->token |= cpu_to_le32(FIELD_PREP(MT_DMA_CTL_TOKEN,
++ token));
++ desc++;
++ }
++
++ return 0;
++
++unmap:
++ mt7915_wed_release_rx_buf(wed);
++ return -ENOMEM;
++}
++
++static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
++ struct mtk_wed_wo_rx_stats *stats)
++{
++ int idx = le16_to_cpu(stats->wlan_idx);
++ struct mt7915_dev *dev;
++ struct mt76_wcid *wcid;
++
++ dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
++
++ if (idx >= mt7915_wtbl_size(dev))
++ return;
++
++ rcu_read_lock();
++
++ wcid = rcu_dereference(dev->mt76.wcid[idx]);
++ if (wcid) {
++ wcid->stats.rx_bytes += le32_to_cpu(stats->rx_byte_cnt);
++ wcid->stats.rx_packets += le32_to_cpu(stats->rx_pkt_cnt);
++ wcid->stats.rx_errors += le32_to_cpu(stats->rx_err_cnt);
++ wcid->stats.rx_drops += le32_to_cpu(stats->rx_drop_cnt);
++ }
++
++ rcu_read_unlock();
++}
+ #endif
+
+ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -602,6 +706,10 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+
+ wed->wlan.pci_dev = pci_dev;
+ wed->wlan.bus_type = MTK_WED_BUS_PCIE;
++ wed->wlan.base = devm_ioremap(dev->mt76.dev,
++ pci_resource_start(pci_dev, 0),
++ pci_resource_len(pci_dev, 0));
++ wed->wlan.phy_base = pci_resource_start(pci_dev, 0);
+ wed->wlan.wpdma_int = pci_resource_start(pci_dev, 0) +
+ MT_INT_WED_SOURCE_CSR;
+ wed->wlan.wpdma_mask = pci_resource_start(pci_dev, 0) +
+@@ -612,6 +720,10 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ MT_TXQ_WED_RING_BASE;
+ wed->wlan.wpdma_txfree = pci_resource_start(pci_dev, 0) +
+ MT_RXQ_WED_RING_BASE;
++ wed->wlan.wpdma_rx_glo = pci_resource_start(pci_dev, 0) +
++ MT_WPDMA_GLO_CFG;
++ wed->wlan.wpdma_rx = pci_resource_start(pci_dev, 0) +
++ MT_RXQ_WED_DATA_RING_BASE;
+ } else {
+ struct platform_device *plat_dev = pdev_ptr;
+ struct resource *res;
+@@ -622,19 +734,45 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+
+ wed->wlan.platform_dev = plat_dev;
+ wed->wlan.bus_type = MTK_WED_BUS_AXI;
++ wed->wlan.base = devm_ioremap(dev->mt76.dev, res->start,
++ resource_size(res));
++ wed->wlan.phy_base = res->start;
+ wed->wlan.wpdma_int = res->start + MT_INT_SOURCE_CSR;
+ wed->wlan.wpdma_mask = res->start + MT_INT_MASK_CSR;
+ wed->wlan.wpdma_tx = res->start + MT_TXQ_WED_RING_BASE;
+ wed->wlan.wpdma_txfree = res->start + MT_RXQ_WED_RING_BASE;
++ wed->wlan.wpdma_rx_glo = res->start + MT_WPDMA_GLO_CFG;
++ wed->wlan.wpdma_rx = res->start + MT_RXQ_WED_DATA_RING_BASE;
+ }
+ wed->wlan.nbuf = 4096;
+ wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
+ wed->wlan.tx_tbit[1] = is_mt7915(&dev->mt76) ? 5 : 31;
+- wed->wlan.txfree_tbit = is_mt7915(&dev->mt76) ? 1 : 2;
++ wed->wlan.txfree_tbit = is_mt7986(&dev->mt76) ? 2 : 1;
+ wed->wlan.token_start = MT7915_TOKEN_SIZE - wed->wlan.nbuf;
++ wed->wlan.wcid_512 = !is_mt7915(&dev->mt76);
++
++ wed->wlan.rx_nbuf = 65536;
++ wed->wlan.rx_npkt = MT7915_WED_RX_TOKEN_SIZE;
++ wed->wlan.rx_size = SKB_WITH_OVERHEAD(MT_RX_BUF_SIZE);
++ if (is_mt7915(&dev->mt76)) {
++ wed->wlan.rx_tbit[0] = 16;
++ wed->wlan.rx_tbit[1] = 17;
++ } else if (is_mt7986(&dev->mt76)) {
++ wed->wlan.rx_tbit[0] = 22;
++ wed->wlan.rx_tbit[1] = 23;
++ } else {
++ wed->wlan.rx_tbit[0] = 18;
++ wed->wlan.rx_tbit[1] = 19;
++ }
++
+ wed->wlan.init_buf = mt7915_wed_init_buf;
+ wed->wlan.offload_enable = mt7915_mmio_wed_offload_enable;
+ wed->wlan.offload_disable = mt7915_mmio_wed_offload_disable;
++ wed->wlan.init_rx_buf = mt7915_wed_init_rx_buf;
++ wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
++ wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
++
++ dev->mt76.rx_token_size = wed->wlan.rx_npkt;
+
+ if (mtk_wed_device_attach(wed))
+ return 0;
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 9cb680e7..42f21343 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -68,6 +68,8 @@
+ #define MT7915_MIN_TWT_DUR 64
+ #define MT7915_MAX_QUEUE (MT_RXQ_BAND2 + __MT_MCUQ_MAX + 2)
+
++#define MT7915_WED_RX_TOKEN_SIZE 12288
++
+ struct mt7915_vif;
+ struct mt7915_sta;
+ struct mt7915_dfs_pulse;
+@@ -501,8 +503,8 @@ int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vi
+ struct cfg80211_he_bss_color *he_bss_color);
+ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ int enable, u32 changed);
+-int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+- bool enable);
++int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
++ struct ieee80211_he_obss_pd *he_obss_pd);
+ int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta, bool changed);
+ int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -526,6 +528,10 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
+ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
+ int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
+ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
++int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower);
++int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
++ struct ieee80211_vif *vif,
++ struct ieee80211_sta *sta, s8 txpower);
+ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action);
+ int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val);
+ int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
+@@ -617,7 +623,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ struct mt76_tx_info *tx_info);
+ void mt7915_tx_token_put(struct mt7915_dev *dev);
+ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+- struct sk_buff *skb);
++ struct sk_buff *skb, u32 *info);
+ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
+ void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
+ void mt7915_stats_work(struct work_struct *work);
+@@ -628,6 +634,7 @@ void mt7915_set_stream_vht_txbf_caps(struct mt7915_phy *phy);
+ void mt7915_update_channel(struct mt76_phy *mphy);
+ int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enable);
+ int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms);
++int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev);
+ int mt7915_init_debugfs(struct mt7915_phy *phy);
+ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int len);
+ bool mt7915_debugfs_rx_log(struct mt7915_dev *dev, const void *data, int len);
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index 0c61f125..aca1b2f1 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -43,6 +43,7 @@ enum reg_rev {
+ SWDEF_BASE_ADDR,
+ TXQ_WED_RING_BASE,
+ RXQ_WED_RING_BASE,
++ RXQ_WED_DATA_RING_BASE,
+ __MT_REG_MAX,
+ };
+
+@@ -588,9 +589,14 @@ enum offs_rev {
+ #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2 BIT(21)
+
+ #define MT_WFDMA0_RST_DTX_PTR MT_WFDMA0(0x20c)
++
++#define MT_WFDMA0_EXT0_CFG MT_WFDMA0(0x2b0)
++#define MT_WFDMA0_EXT0_RXWB_KEEP BIT(10)
++
+ #define MT_WFDMA0_PRI_DLY_INT_CFG0 MT_WFDMA0(0x2f0)
+ #define MT_WFDMA0_PRI_DLY_INT_CFG1 MT_WFDMA0(0x2f4)
+ #define MT_WFDMA0_PRI_DLY_INT_CFG2 MT_WFDMA0(0x2f8)
++#define MT_WPDMA_GLO_CFG MT_WFDMA0(0x208)
+
+ /* WFDMA1 */
+ #define MT_WFDMA1_BASE 0xd5000
+@@ -686,6 +692,7 @@ enum offs_rev {
+
+ #define MT_TXQ_WED_RING_BASE __REG(TXQ_WED_RING_BASE)
+ #define MT_RXQ_WED_RING_BASE __REG(RXQ_WED_RING_BASE)
++#define MT_RXQ_WED_DATA_RING_BASE __REG(RXQ_WED_DATA_RING_BASE)
+
+ #define MT_INT_SOURCE_CSR __REG(INT_SOURCE_CSR)
+ #define MT_INT_MASK_CSR __REG(INT_MASK_CSR)
+@@ -1179,6 +1186,10 @@ enum offs_rev {
+ #define MT_WF_PHY_RXTD12_IRPI_SW_CLR_ONLY BIT(18)
+ #define MT_WF_PHY_RXTD12_IRPI_SW_CLR BIT(29)
+
++#define MT_WF_PHY_TPC_CTRL_STAT(_phy) MT_WF_PHY(0xe7a0 + ((_phy) << 16))
++#define MT_WF_PHY_TPC_CTRL_STAT_MT7916(_phy) MT_WF_PHY(0xe7a0 + ((_phy) << 20))
++#define MT_WF_PHY_TPC_POWER GENMASK(15, 8)
++
+ #define MT_MCU_WM_CIRQ_BASE 0x89010000
+ #define MT_MCU_WM_CIRQ(ofs) (MT_MCU_WM_CIRQ_BASE + (ofs))
+ #define MT_MCU_WM_CIRQ_IRQ_MASK_CLR_ADDR MT_MCU_WM_CIRQ(0x80)
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index a979460f..7ace05e0 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -44,14 +44,14 @@ mt7915_tm_set_tx_power(struct mt7915_phy *phy)
+ int ret;
+ struct {
+ u8 format_id;
+- u8 dbdc_idx;
++ u8 band_idx;
+ s8 tx_power;
+ u8 ant_idx; /* Only 0 is valid */
+ u8 center_chan;
+ u8 rsv[3];
+ } __packed req = {
+ .format_id = 0xf,
+- .dbdc_idx = phy != &dev->phy,
++ .band_idx = phy->band_idx,
+ .center_chan = ieee80211_frequency_to_channel(freq),
+ };
+ u8 *tx_power = NULL;
+@@ -77,7 +77,7 @@ mt7915_tm_set_freq_offset(struct mt7915_phy *phy, bool en, u32 val)
+ struct mt7915_tm_cmd req = {
+ .testmode_en = en,
+ .param_idx = MCU_ATE_SET_FREQ_OFFSET,
+- .param.freq.band = phy != &dev->phy,
++ .param.freq.band = phy->band_idx,
+ .param.freq.freq_offset = cpu_to_le32(val),
+ };
+
+@@ -111,7 +111,7 @@ mt7915_tm_set_trx(struct mt7915_phy *phy, int type, bool en)
+ .param_idx = MCU_ATE_SET_TRX,
+ .param.trx.type = type,
+ .param.trx.enable = en,
+- .param.trx.band = phy != &dev->phy,
++ .param.trx.band = phy->band_idx,
+ };
+
+ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
+@@ -126,7 +126,7 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
+ .testmode_en = 1,
+ .param_idx = MCU_ATE_CLEAN_TXQUEUE,
+ .param.clean.wcid = wcid,
+- .param.clean.band = phy != &dev->phy,
++ .param.clean.band = phy->band_idx,
+ };
+
+ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
+@@ -144,7 +144,7 @@ mt7915_tm_set_slot_time(struct mt7915_phy *phy, u8 slot_time, u8 sifs)
+ .param.slot.sifs = sifs,
+ .param.slot.rifs = 2,
+ .param.slot.eifs = cpu_to_le16(60),
+- .param.slot.band = phy != &dev->phy,
++ .param.slot.band = phy->band_idx,
+ };
+
+ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
+@@ -488,7 +488,7 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+ mt7915_tm_update_channel(phy);
+
+ /* read-clear */
+- mt76_rr(dev, MT_MIB_SDR3(phy != &dev->phy));
++ mt76_rr(dev, MT_MIB_SDR3(phy->band_idx));
+ mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
+ }
+ }
+@@ -526,7 +526,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+ tx_cont->control_ch = chandef->chan->hw_value;
+ tx_cont->center_ch = freq1;
+ tx_cont->tx_ant = td->tx_antenna_mask;
+- tx_cont->band = phy != &dev->phy;
++ tx_cont->band = phy->band_idx;
+
+ switch (chandef->width) {
+ case NL80211_CHAN_WIDTH_40:
+@@ -558,7 +558,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+ }
+
+ if (!en) {
+- req.op.rf.param.func_data = cpu_to_le32(phy != &dev->phy);
++ req.op.rf.param.func_data = cpu_to_le32(phy->band_idx);
+ goto out;
+ }
+
+diff --git a/mt7921/init.c b/mt7921/init.c
+index 739d18fc..e42cb6be 100644
+--- a/mt7921/init.c
++++ b/mt7921/init.c
+@@ -2,6 +2,7 @@
+ /* Copyright (C) 2020 MediaTek Inc. */
+
+ #include <linux/etherdevice.h>
++#include <linux/firmware.h>
+ #include "mt7921.h"
+ #include "mac.h"
+ #include "mcu.h"
+@@ -37,6 +38,7 @@ mt7921_regd_notifier(struct wiphy *wiphy,
+
+ memcpy(dev->mt76.alpha2, request->alpha2, sizeof(dev->mt76.alpha2));
+ dev->mt76.region = request->dfs_region;
++ dev->country_ie_env = request->country_ie_env;
+
+ mt7921_mutex_acquire(dev);
+ mt7921_mcu_set_clc(dev, request->alpha2, request->country_ie_env);
+@@ -65,12 +67,18 @@ mt7921_init_wiphy(struct ieee80211_hw *hw)
+ hw->sta_data_size = sizeof(struct mt7921_sta);
+ hw->vif_data_size = sizeof(struct mt7921_vif);
+
++ if (dev->fw_features & MT7921_FW_CAP_CNM)
++ wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
++ else
++ wiphy->flags &= ~WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
++
+ wiphy->iface_combinations = if_comb;
+ wiphy->flags &= ~(WIPHY_FLAG_IBSS_RSN | WIPHY_FLAG_4ADDR_AP |
+ WIPHY_FLAG_4ADDR_STATION);
+ wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+ BIT(NL80211_IFTYPE_AP);
+ wiphy->n_iface_combinations = ARRAY_SIZE(if_comb);
++ wiphy->max_remain_on_channel_duration = 5000;
+ wiphy->max_scan_ie_len = MT76_CONNAC_SCAN_IE_LEN;
+ wiphy->max_scan_ssids = 4;
+ wiphy->max_sched_scan_plan_interval =
+@@ -129,6 +137,58 @@ mt7921_mac_init_band(struct mt7921_dev *dev, u8 band)
+ mt76_clear(dev, MT_DMA_DCR0(band), MT_DMA_DCR0_RXD_G5_EN);
+ }
+
++u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm)
++{
++ struct mt7921_fw_features *features = NULL;
++ const struct mt76_connac2_fw_trailer *hdr;
++ struct mt7921_realease_info *rel_info;
++ const struct firmware *fw;
++ int ret, i, offset = 0;
++ const u8 *data, *end;
++
++ ret = request_firmware(&fw, fw_wm, dev);
++ if (ret)
++ return ret;
++
++ if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
++ dev_err(dev, "Invalid firmware\n");
++ return -EINVAL;
++ }
++
++ data = fw->data;
++ hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
++
++ for (i = 0; i < hdr->n_region; i++) {
++ const struct mt76_connac2_fw_region *region;
++
++ region = (const void *)((const u8 *)hdr -
++ (hdr->n_region - i) * sizeof(*region));
++ offset += le32_to_cpu(region->len);
++ }
++
++ data += offset + 16;
++ rel_info = (struct mt7921_realease_info *)data;
++ data += sizeof(*rel_info);
++ end = data + le16_to_cpu(rel_info->len);
++
++ while (data < end) {
++ rel_info = (struct mt7921_realease_info *)data;
++ data += sizeof(*rel_info);
++
++ if (rel_info->tag == MT7921_FW_TAG_FEATURE) {
++ features = (struct mt7921_fw_features *)data;
++ break;
++ }
++
++ data += le16_to_cpu(rel_info->len) + rel_info->pad_len;
++ }
++
++ release_firmware(fw);
++
++ return features ? features->data : 0;
++}
++EXPORT_SYMBOL_GPL(mt7921_check_offload_capability);
++
+ int mt7921_mac_init(struct mt7921_dev *dev)
+ {
+ int i;
+@@ -278,6 +338,10 @@ int mt7921_register_device(struct mt7921_dev *dev)
+ INIT_WORK(&dev->reset_work, mt7921_mac_reset_work);
+ INIT_WORK(&dev->init_work, mt7921_init_work);
+
++ INIT_WORK(&dev->phy.roc_work, mt7921_roc_work);
++ timer_setup(&dev->phy.roc_timer, mt7921_roc_timer, 0);
++ init_waitqueue_head(&dev->phy.roc_wait);
++
+ dev->pm.idle_timeout = MT7921_PM_TIMEOUT;
+ dev->pm.stats.last_wake_event = jiffies;
+ dev->pm.stats.last_doze_event = jiffies;
+diff --git a/mt7921/mac.c b/mt7921/mac.c
+index 7b15193c..639614b0 100644
+--- a/mt7921/mac.c
++++ b/mt7921/mac.c
+@@ -692,7 +692,7 @@ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
+ EXPORT_SYMBOL_GPL(mt7921_rx_check);
+
+ void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+- struct sk_buff *skb)
++ struct sk_buff *skb, u32 *info)
+ {
+ struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
+ __le32 *rxd = (__le32 *)skb->data;
+diff --git a/mt7921/main.c b/mt7921/main.c
+index 00085b12..1b7219e3 100644
+--- a/mt7921/main.c
++++ b/mt7921/main.c
+@@ -385,6 +385,116 @@ static void mt7921_remove_interface(struct ieee80211_hw *hw,
+ mt76_packet_id_flush(&dev->mt76, &msta->wcid);
+ }
+
++static void mt7921_roc_iter(void *priv, u8 *mac,
++ struct ieee80211_vif *vif)
++{
++ struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
++ struct mt7921_phy *phy = priv;
++
++ mt7921_mcu_abort_roc(phy, mvif, phy->roc_token_id);
++}
++
++void mt7921_roc_work(struct work_struct *work)
++{
++ struct mt7921_phy *phy;
++
++ phy = (struct mt7921_phy *)container_of(work, struct mt7921_phy,
++ roc_work);
++
++ if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state))
++ return;
++
++ mt7921_mutex_acquire(phy->dev);
++ ieee80211_iterate_active_interfaces(phy->mt76->hw,
++ IEEE80211_IFACE_ITER_RESUME_ALL,
++ mt7921_roc_iter, phy);
++ mt7921_mutex_release(phy->dev);
++ ieee80211_remain_on_channel_expired(phy->mt76->hw);
++}
++
++void mt7921_roc_timer(struct timer_list *timer)
++{
++ struct mt7921_phy *phy = from_timer(phy, timer, roc_timer);
++
++ ieee80211_queue_work(phy->mt76->hw, &phy->roc_work);
++}
++
++static int mt7921_abort_roc(struct mt7921_phy *phy, struct mt7921_vif *vif)
++{
++ int err;
++
++ if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state))
++ return 0;
++
++ del_timer_sync(&phy->roc_timer);
++ cancel_work_sync(&phy->roc_work);
++ err = mt7921_mcu_abort_roc(phy, vif, phy->roc_token_id);
++ clear_bit(MT76_STATE_ROC, &phy->mt76->state);
++
++ return err;
++}
++
++static int mt7921_set_roc(struct mt7921_phy *phy,
++ struct mt7921_vif *vif,
++ struct ieee80211_channel *chan,
++ int duration,
++ enum mt7921_roc_req type)
++{
++ int err;
++
++ if (test_and_set_bit(MT76_STATE_ROC, &phy->mt76->state))
++ return -EBUSY;
++
++ phy->roc_grant = false;
++
++ err = mt7921_mcu_set_roc(phy, vif, chan, duration, type,
++ ++phy->roc_token_id);
++ if (err < 0) {
++ clear_bit(MT76_STATE_ROC, &phy->mt76->state);
++ goto out;
++ }
++
++ if (!wait_event_timeout(phy->roc_wait, phy->roc_grant, HZ)) {
++ mt7921_mcu_abort_roc(phy, vif, phy->roc_token_id);
++ clear_bit(MT76_STATE_ROC, &phy->mt76->state);
++ err = -ETIMEDOUT;
++ }
++
++out:
++ return err;
++}
++
++static int mt7921_remain_on_channel(struct ieee80211_hw *hw,
++ struct ieee80211_vif *vif,
++ struct ieee80211_channel *chan,
++ int duration,
++ enum ieee80211_roc_type type)
++{
++ struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
++ struct mt7921_phy *phy = mt7921_hw_phy(hw);
++ int err;
++
++ mt7921_mutex_acquire(phy->dev);
++ err = mt7921_set_roc(phy, mvif, chan, duration, MT7921_ROC_REQ_ROC);
++ mt7921_mutex_release(phy->dev);
++
++ return err;
++}
++
++static int mt7921_cancel_remain_on_channel(struct ieee80211_hw *hw,
++ struct ieee80211_vif *vif)
++{
++ struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
++ struct mt7921_phy *phy = mt7921_hw_phy(hw);
++ int err;
++
++ mt7921_mutex_acquire(phy->dev);
++ err = mt7921_abort_roc(phy, mvif);
++ mt7921_mutex_release(phy->dev);
++
++ return err;
++}
++
+ static int mt7921_set_channel(struct mt7921_phy *phy)
+ {
+ struct mt7921_dev *dev = phy->dev;
+@@ -1503,7 +1613,13 @@ static int mt7921_set_sar_specs(struct ieee80211_hw *hw,
+ int err;
+
+ mt7921_mutex_acquire(dev);
++ err = mt7921_mcu_set_clc(dev, dev->mt76.alpha2,
++ dev->country_ie_env);
++ if (err < 0)
++ goto out;
++
+ err = mt7921_set_tx_sar_pwr(hw, sar);
++out:
+ mt7921_mutex_release(dev);
+
+ return err;
+@@ -1621,6 +1737,8 @@ const struct ieee80211_ops mt7921_ops = {
+ #endif /* CONFIG_PM */
+ .flush = mt7921_flush,
+ .set_sar_specs = mt7921_set_sar_specs,
++ .remain_on_channel = mt7921_remain_on_channel,
++ .cancel_remain_on_channel = mt7921_cancel_remain_on_channel,
+ };
+ EXPORT_SYMBOL_GPL(mt7921_ops);
+
+diff --git a/mt7921/mcu.c b/mt7921/mcu.c
+index 104da7e1..b7ed744f 100644
+--- a/mt7921/mcu.c
++++ b/mt7921/mcu.c
+@@ -154,6 +154,29 @@ void mt7921_mcu_set_suspend_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
+
+ #endif /* CONFIG_PM */
+
++static void
++mt7921_mcu_uni_roc_event(struct mt7921_dev *dev, struct sk_buff *skb)
++{
++ struct mt7921_roc_grant_tlv *grant;
++ struct mt76_connac2_mcu_rxd *rxd;
++ int duration;
++
++ rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
++ grant = (struct mt7921_roc_grant_tlv *)(rxd->tlv + 4);
++
++ /* should never happen */
++ WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
++
++ if (grant->reqtype == MT7921_ROC_REQ_ROC)
++ ieee80211_ready_on_channel(dev->mt76.phy.hw);
++
++ dev->phy.roc_grant = true;
++ wake_up(&dev->phy.roc_wait);
++ duration = le32_to_cpu(grant->max_interval);
++ mod_timer(&dev->phy.roc_timer,
++ round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
++}
++
+ static void
+ mt7921_mcu_scan_event(struct mt7921_dev *dev, struct sk_buff *skb)
+ {
+@@ -295,6 +318,7 @@ mt7921_mcu_uni_rx_unsolicited_event(struct mt7921_dev *dev,
+
+ switch (rxd->eid) {
+ case MCU_UNI_EVENT_ROC:
++ mt7921_mcu_uni_roc_event(dev, skb);
+ break;
+ default:
+ break;
+diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
+index d9d78f6b..e915dfce 100644
+--- a/mt7921/mt7921.h
++++ b/mt7921/mt7921.h
+@@ -32,6 +32,9 @@
+ #define MT7921_MCU_INIT_RETRY_COUNT 10
+ #define MT7921_WFSYS_INIT_RETRY_COUNT 2
+
++#define MT7921_FW_TAG_FEATURE 4
++#define MT7921_FW_CAP_CNM BIT(7)
++
+ #define MT7921_FIRMWARE_WM "mediatek/WIFI_RAM_CODE_MT7961_1.bin"
+ #define MT7921_ROM_PATCH "mediatek/WIFI_MT7961_patch_mcu_1_2_hdr.bin"
+
+@@ -67,6 +70,41 @@ enum mt7921_roc_req {
+ MT7921_ROC_REQ_NUM
+ };
+
++enum {
++ UNI_EVENT_ROC_GRANT = 0,
++ UNI_EVENT_ROC_TAG_NUM
++};
++
++struct mt7921_realease_info {
++ __le16 len;
++ u8 pad_len;
++ u8 tag;
++} __packed;
++
++struct mt7921_fw_features {
++ u8 segment;
++ u8 data;
++ u8 rsv[14];
++} __packed;
++
++struct mt7921_roc_grant_tlv {
++ __le16 tag;
++ __le16 len;
++ u8 bss_idx;
++ u8 tokenid;
++ u8 status;
++ u8 primarychannel;
++ u8 rfsco;
++ u8 rfband;
++ u8 channelwidth;
++ u8 centerfreqseg1;
++ u8 centerfreqseg2;
++ u8 reqtype;
++ u8 dbdcband;
++ u8 rsv[1];
++ __le32 max_interval;
++} __packed;
++
+ enum mt7921_sdio_pkt_type {
+ MT7921_SDIO_TXD,
+ MT7921_SDIO_DATA,
+@@ -214,6 +252,12 @@ struct mt7921_phy {
+ #endif
+
+ struct mt7921_clc *clc[MT7921_CLC_MAX_NUM];
++
++ struct work_struct roc_work;
++ struct timer_list roc_timer;
++ wait_queue_head_t roc_wait;
++ u8 roc_token_id;
++ bool roc_grant;
+ };
+
+ #define mt7921_init_reset(dev) ((dev)->hif_ops->init_reset(dev))
+@@ -250,6 +294,7 @@ struct mt7921_dev {
+ struct work_struct init_work;
+
+ u8 fw_debug;
++ u8 fw_features;
+
+ struct mt76_connac_pm pm;
+ struct mt76_connac_coredump coredump;
+@@ -258,6 +303,8 @@ struct mt7921_dev {
+ struct work_struct ipv6_ns_work;
+ /* IPv6 addresses for WoWLAN */
+ struct sk_buff_head ipv6_ns_list;
++
++ enum environment_cap country_ie_env;
+ };
+
+ enum {
+@@ -422,7 +469,7 @@ void mt7921_tx_worker(struct mt76_worker *w);
+ void mt7921_tx_token_put(struct mt7921_dev *dev);
+ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len);
+ void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+- struct sk_buff *skb);
++ struct sk_buff *skb, u32 *info);
+ void mt7921_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
+ void mt7921_stats_work(struct work_struct *work);
+ void mt7921_set_stream_he_caps(struct mt7921_phy *phy);
+@@ -439,6 +486,8 @@ int mt7921_mcu_uni_rx_ba(struct mt7921_dev *dev,
+ struct ieee80211_ampdu_params *params,
+ bool enable);
+ void mt7921_scan_work(struct work_struct *work);
++void mt7921_roc_work(struct work_struct *work);
++void mt7921_roc_timer(struct timer_list *timer);
+ int mt7921_mcu_uni_bss_ps(struct mt7921_dev *dev, struct ieee80211_vif *vif);
+ int mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev);
+ int mt7921_mcu_fw_pmctrl(struct mt7921_dev *dev);
+@@ -527,4 +576,5 @@ int mt7921_mcu_set_roc(struct mt7921_phy *phy, struct mt7921_vif *vif,
+ enum mt7921_roc_req type, u8 token_id);
+ int mt7921_mcu_abort_roc(struct mt7921_phy *phy, struct mt7921_vif *vif,
+ u8 token_id);
++u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm);
+ #endif
+diff --git a/mt7921/pci.c b/mt7921/pci.c
+index 4f34cb9e..fbb06f04 100644
+--- a/mt7921/pci.c
++++ b/mt7921/pci.c
+@@ -13,10 +13,14 @@
+ #include "../trace.h"
+
+ static const struct pci_device_id mt7921_pci_device_table[] = {
+- { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7961) },
+- { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7922) },
+- { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0608) },
+- { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0616) },
++ { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7961),
++ .driver_data = (kernel_ulong_t)MT7921_FIRMWARE_WM },
++ { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7922),
++ .driver_data = (kernel_ulong_t)MT7922_FIRMWARE_WM },
++ { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0608),
++ .driver_data = (kernel_ulong_t)MT7921_FIRMWARE_WM },
++ { PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0616),
++ .driver_data = (kernel_ulong_t)MT7921_FIRMWARE_WM },
+ { },
+ };
+
+@@ -253,9 +257,11 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
+ .fw_own = mt7921e_mcu_fw_pmctrl,
+ };
+
++ struct ieee80211_ops *ops;
+ struct mt76_bus_ops *bus_ops;
+ struct mt7921_dev *dev;
+ struct mt76_dev *mdev;
++ u8 features;
+ int ret;
+
+ ret = pcim_enable_device(pdev);
+@@ -279,8 +285,21 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
+ if (mt7921_disable_aspm)
+ mt76_pci_disable_aspm(pdev);
+
+- mdev = mt76_alloc_device(&pdev->dev, sizeof(*dev), &mt7921_ops,
+- &drv_ops);
++ features = mt7921_check_offload_capability(&pdev->dev, (const char *)
++ id->driver_data);
++ ops = devm_kmemdup(&pdev->dev, &mt7921_ops, sizeof(mt7921_ops),
++ GFP_KERNEL);
++ if (!ops) {
++ ret = -ENOMEM;
++ goto err_free_pci_vec;
++ }
++
++ if (!(features & MT7921_FW_CAP_CNM)) {
++ ops->remain_on_channel = NULL;
++ ops->cancel_remain_on_channel = NULL;
++ }
++
++ mdev = mt76_alloc_device(&pdev->dev, sizeof(*dev), ops, &drv_ops);
+ if (!mdev) {
+ ret = -ENOMEM;
+ goto err_free_pci_vec;
+@@ -289,8 +308,8 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
+ pci_set_drvdata(pdev, mdev);
+
+ dev = container_of(mdev, struct mt7921_dev, mt76);
++ dev->fw_features = features;
+ dev->hif_ops = &mt7921_pcie_ops;
+-
+ mt76_mmio_init(&dev->mt76, pcim_iomap_table(pdev)[0]);
+ tasklet_init(&dev->irq_tasklet, mt7921_irq_tasklet, (unsigned long)dev);
+
+diff --git a/mt7921/sdio.c b/mt7921/sdio.c
+index 031d99d4..f6b35087 100644
+--- a/mt7921/sdio.c
++++ b/mt7921/sdio.c
+@@ -17,7 +17,8 @@
+ #include "mcu.h"
+
+ static const struct sdio_device_id mt7921s_table[] = {
+- { SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, 0x7901) },
++ { SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, 0x7901),
++ .driver_data = (kernel_ulong_t)MT7921_FIRMWARE_WM },
+ { } /* Terminating entry */
+ };
+
+@@ -122,18 +123,32 @@ static int mt7921s_probe(struct sdio_func *func,
+ .fw_own = mt7921s_mcu_fw_pmctrl,
+ };
+
++ struct ieee80211_ops *ops;
+ struct mt7921_dev *dev;
+ struct mt76_dev *mdev;
++ u8 features;
+ int ret;
+
+- mdev = mt76_alloc_device(&func->dev, sizeof(*dev), &mt7921_ops,
+- &drv_ops);
++ features = mt7921_check_offload_capability(&func->dev, (const char *)
++ id->driver_data);
++
++ ops = devm_kmemdup(&func->dev, &mt7921_ops, sizeof(mt7921_ops),
++ GFP_KERNEL);
++ if (!ops)
++ return -ENOMEM;
++
++ if (!(features & MT7921_FW_CAP_CNM)) {
++ ops->remain_on_channel = NULL;
++ ops->cancel_remain_on_channel = NULL;
++ }
++
++ mdev = mt76_alloc_device(&func->dev, sizeof(*dev), ops, &drv_ops);
+ if (!mdev)
+ return -ENOMEM;
+
+ dev = container_of(mdev, struct mt7921_dev, mt76);
++ dev->fw_features = features;
+ dev->hif_ops = &mt7921_sdio_ops;
+-
+ sdio_set_drvdata(func, dev);
+
+ ret = mt76s_init(mdev, func, &mt7921s_ops);
+diff --git a/mt7921/usb.c b/mt7921/usb.c
+index 89249f0b..8a49d3de 100644
+--- a/mt7921/usb.c
++++ b/mt7921/usb.c
+@@ -13,7 +13,8 @@
+ #include "mac.h"
+
+ static const struct usb_device_id mt7921u_device_table[] = {
+- { USB_DEVICE_AND_INTERFACE_INFO(0x0e8d, 0x7961, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x0e8d, 0x7961, 0xff, 0xff, 0xff),
++ .driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM },
+ { },
+ };
+
+@@ -204,13 +205,21 @@ static int mt7921u_probe(struct usb_interface *usb_intf,
+ struct ieee80211_hw *hw;
+ struct mt7921_dev *dev;
+ struct mt76_dev *mdev;
++ u8 features;
+ int ret;
+
++ features = mt7921_check_offload_capability(&usb_intf->dev, (const char *)
++ id->driver_info);
+ ops = devm_kmemdup(&usb_intf->dev, &mt7921_ops, sizeof(mt7921_ops),
+ GFP_KERNEL);
+ if (!ops)
+ return -ENOMEM;
+
++ if (!(features & MT7921_FW_CAP_CNM)) {
++ ops->remain_on_channel = NULL;
++ ops->cancel_remain_on_channel = NULL;
++ }
++
+ ops->stop = mt7921u_stop;
+
+ mdev = mt76_alloc_device(&usb_intf->dev, sizeof(*dev), ops, &drv_ops);
+@@ -218,6 +227,7 @@ static int mt7921u_probe(struct usb_interface *usb_intf,
+ return -ENOMEM;
+
+ dev = container_of(mdev, struct mt7921_dev, mt76);
++ dev->fw_features = features;
+ dev->hif_ops = &hif_ops;
+
+ udev = usb_get_dev(udev);
+diff --git a/sdio.c b/sdio.c
+index 0ec308f9..228bc7d4 100644
+--- a/sdio.c
++++ b/sdio.c
+@@ -395,7 +395,7 @@ mt76s_process_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
+ if (!e || !e->skb)
+ break;
+
+- dev->drv->rx_skb(dev, MT_RXQ_MAIN, e->skb);
++ dev->drv->rx_skb(dev, MT_RXQ_MAIN, e->skb, NULL);
+ e->skb = NULL;
+ nframes++;
+ }
+diff --git a/tx.c b/tx.c
+index 65e2b7c1..c8d78b0a 100644
+--- a/tx.c
++++ b/tx.c
+@@ -751,6 +751,23 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
+ }
+ EXPORT_SYMBOL_GPL(mt76_token_consume);
+
++int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
++ struct mt76_txwi_cache *t, dma_addr_t phys)
++{
++ int token;
++
++ spin_lock_bh(&dev->rx_token_lock);
++ token = idr_alloc(&dev->rx_token, t, 0, dev->rx_token_size,
++ GFP_ATOMIC);
++ spin_unlock_bh(&dev->rx_token_lock);
++
++ t->ptr = ptr;
++ t->dma_addr = phys;
++
++ return token;
++}
++EXPORT_SYMBOL_GPL(mt76_rx_token_consume);
++
+ struct mt76_txwi_cache *
+ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
+ {
+@@ -779,3 +796,16 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
+ return txwi;
+ }
+ EXPORT_SYMBOL_GPL(mt76_token_release);
++
++struct mt76_txwi_cache *
++mt76_rx_token_release(struct mt76_dev *dev, int token)
++{
++ struct mt76_txwi_cache *t;
++
++ spin_lock_bh(&dev->rx_token_lock);
++ t = idr_remove(&dev->rx_token, token);
++ spin_unlock_bh(&dev->rx_token_lock);
++
++ return t;
++}
++EXPORT_SYMBOL_GPL(mt76_rx_token_release);
+diff --git a/usb.c b/usb.c
+index 50d07d91..369c27ab 100644
+--- a/usb.c
++++ b/usb.c
+@@ -547,7 +547,7 @@ mt76u_process_rx_entry(struct mt76_dev *dev, struct urb *urb,
+ len -= data_len;
+ nsgs++;
+ }
+- dev->drv->rx_skb(dev, MT_RXQ_MAIN, skb);
++ dev->drv->rx_skb(dev, MT_RXQ_MAIN, skb, NULL);
+
+ return nsgs;
+ }
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch b/recipes-wifi/linux-mt76/files/patches-3.x/100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch
new file mode 100644
index 0000000..24b1240
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch
@@ -0,0 +1,26 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 23 Nov 2021 17:01:45 +0100
+Subject: [PATCH] Revert "of: net: pass the dst buffer to of_get_mac_address()"
+
+This reverts commit 4932c5d80153c336c77dbe8d7af9f8fdd879d01f.
+---
+
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -105,9 +105,15 @@ mt76_eeprom_override(struct mt76_phy *ph
+ {
+ struct mt76_dev *dev = phy->dev;
+
++#ifdef CONFIG_OF
+ struct device_node *np = dev->dev->of_node;
++ const u8 *mac = NULL;
+
+- of_get_mac_address(np, phy->macaddr);
++ if (np)
++ mac = of_get_mac_address(np);
++ if (!IS_ERR_OR_NULL(mac))
++ ether_addr_copy(phy->macaddr, mac);
++#endif
+
+ if (!is_valid_ether_addr(phy->macaddr)) {
+ eth_random_addr(phy->macaddr);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
new file mode 100644
index 0000000..d1fa706
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -0,0 +1,4895 @@
+From 6f3fdaaef8dcd1d95017aaf1755cf001168d0836 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Wed, 22 Jun 2022 10:39:47 +0800
+Subject: [PATCH 1001/1010] mt76: mt7915: add mtk internal debug tools for mt76
+
+---
+ mt76_connac_mcu.h | 7 +
+ mt7915/Makefile | 2 +-
+ mt7915/debugfs.c | 73 +-
+ mt7915/mac.c | 14 +
+ mt7915/main.c | 4 +
+ mt7915/mcu.c | 63 +
+ mt7915/mcu.h | 4 +
+ mt7915/mt7915.h | 44 +
+ mt7915/mt7915_debug.h | 1350 +++++++++++++++++++
+ mt7915/mtk_debugfs.c | 2925 +++++++++++++++++++++++++++++++++++++++++
+ mt7915/mtk_mcu.c | 51 +
+ tools/fwlog.c | 44 +-
+ 12 files changed, 4568 insertions(+), 13 deletions(-)
+ create mode 100644 mt7915/mt7915_debug.h
+ create mode 100644 mt7915/mtk_debugfs.c
+ create mode 100644 mt7915/mtk_mcu.c
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 72d235a1..ff733f9f 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1135,6 +1135,7 @@ enum {
+ MCU_EXT_CMD_SET_TX_POWER_CTRL = 0x11,
+ MCU_EXT_CMD_FW_LOG_2_HOST = 0x13,
+ MCU_EXT_CMD_TXBF_ACTION = 0x1e,
++ MCU_EXT_CMD_MEC_CTRL = 0x1f,
+ MCU_EXT_CMD_EFUSE_BUFFER_MODE = 0x21,
+ MCU_EXT_CMD_THERMAL_PROT = 0x23,
+ MCU_EXT_CMD_STA_REC_UPDATE = 0x25,
+@@ -1158,6 +1159,12 @@ enum {
+ MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
+ MCU_EXT_CMD_RXDCOC_CAL = 0x59,
+ MCU_EXT_CMD_GET_MIB_INFO = 0x5a,
++#ifdef MTK_DEBUG
++ MCU_EXT_CMD_RED_ENABLE = 0x68,
++ MCU_EXT_CMD_RED_SHOW_STA = 0x69,
++ MCU_EXT_CMD_RED_TARGET_DELAY = 0x6A,
++ MCU_EXT_CMD_RED_TX_RPT = 0x6B,
++#endif
+ MCU_EXT_CMD_TXDPD_CAL = 0x60,
+ MCU_EXT_CMD_CAL_CACHE = 0x67,
+ MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
+diff --git a/mt7915/Makefile b/mt7915/Makefile
+index 797ae498..a42866e9 100644
+--- a/mt7915/Makefile
++++ b/mt7915/Makefile
+@@ -3,7 +3,7 @@
+ obj-$(CONFIG_MT7915E) += mt7915e.o
+
+ mt7915e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
+- debugfs.o mmio.o
++ debugfs.o mmio.o mtk_debugfs.o mtk_mcu.o
+
+ mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
+ mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
+diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
+index 30f8f18b..092d8434 100644
+--- a/mt7915/debugfs.c
++++ b/mt7915/debugfs.c
+@@ -8,6 +8,9 @@
+ #include "mac.h"
+
+ #define FW_BIN_LOG_MAGIC 0x44e98caf
++#ifdef MTK_DEBUG
++#define FW_BIN_LOG_MAGIC_V2 0x44d9c99a
++#endif
+
+ /** global debugfs **/
+
+@@ -504,6 +507,9 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
+ int ret;
+
+ dev->fw.debug_wm = val ? MCU_FW_LOG_TO_HOST : 0;
++#ifdef MTK_DEBUG
++ dev->fw.debug_wm = val;
++#endif
+
+ if (dev->fw.debug_bin)
+ val = 16;
+@@ -528,6 +534,9 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
+ if (ret)
+ goto out;
+ }
++#ifdef MTK_DEBUG
++ mt7915_mcu_fw_dbg_ctrl(dev, 68, !!val);
++#endif
+
+ /* WM CPU info record control */
+ mt76_clear(dev, MT_CPU_UTIL_CTRL, BIT(0));
+@@ -535,6 +544,12 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
+ mt76_wr(dev, MT_MCU_WM_CIRQ_IRQ_MASK_CLR_ADDR, BIT(5));
+ mt76_wr(dev, MT_MCU_WM_CIRQ_IRQ_SOFT_ADDR, BIT(5));
+
++#ifdef MTK_DEBUG
++ if (dev->fw.debug_bin & BIT(3))
++ /* use bit 7 to indicate v2 magic number */
++ dev->fw.debug_wm |= BIT(7);
++#endif
++
+ out:
+ if (ret)
+ dev->fw.debug_wm = 0;
+@@ -547,7 +562,11 @@ mt7915_fw_debug_wm_get(void *data, u64 *val)
+ {
+ struct mt7915_dev *dev = data;
+
+- *val = dev->fw.debug_wm;
++#ifdef MTK_DEBUG
++ *val = dev->fw.debug_wm & ~BIT(7);
++#else
++ val = dev->fw.debug_wm;
++#endif
+
+ return 0;
+ }
+@@ -632,6 +651,17 @@ mt7915_fw_debug_bin_set(void *data, u64 val)
+
+ relay_reset(dev->relay_fwlog);
+
++#ifdef MTK_DEBUG
++ dev->dbg.dump_mcu_pkt = val & BIT(4) ? true : false;
++ dev->dbg.dump_txd = val & BIT(5) ? true : false;
++ dev->dbg.dump_tx_pkt = val & BIT(6) ? true : false;
++ dev->dbg.dump_rx_pkt = val & BIT(7) ? true : false;
++ dev->dbg.dump_rx_raw = val & BIT(8) ? true : false;
++ if (!(val & GENMASK(3, 0)))
++ return 0;
++#endif
++
++
+ return mt7915_fw_debug_wm_set(dev, dev->fw.debug_wm);
+ }
+
+@@ -1103,6 +1133,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+ if (!ext_phy)
+ dev->debugfs_dir = dir;
+
++#ifdef MTK_DEBUG
++ debugfs_create_u16("wlan_idx", 0600, dir, &dev->wlan_idx);
++ mt7915_mtk_init_debugfs(phy, dir);
++#endif
++
+ return 0;
+ }
+
+@@ -1143,17 +1178,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
+ .msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
+ };
+
++#ifdef MTK_DEBUG
++ struct {
++ __le32 magic;
++ u8 version;
++ u8 _rsv;
++ __le16 serial_id;
++ __le32 timestamp;
++ __le16 msg_type;
++ __le16 len;
++ } hdr2 = {
++ .version = 0x1,
++ .magic = cpu_to_le32(FW_BIN_LOG_MAGIC_V2),
++ .msg_type = PKT_TYPE_RX_FW_MONITOR,
++ };
++#endif
++
+ if (!dev->relay_fwlog)
+ return;
+
++#ifdef MTK_DEBUG
++ /* old magic num */
++ if (!(dev->fw.debug_wm & BIT(7))) {
++ hdr.timestamp = mt76_rr(dev, MT_LPON_FRCR(0));
++ hdr.len = *(__le16 *)data;
++ mt7915_debugfs_write_fwlog(dev, &hdr, sizeof(hdr), data, len);
++ } else {
++ hdr2.serial_id = dev->dbg.fwlog_seq++;
++ hdr2.timestamp = mt76_rr(dev, MT_LPON_FRCR(0));
++ hdr2.len = *(__le16 *)data;
++ mt7915_debugfs_write_fwlog(dev, &hdr2, sizeof(hdr2), data, len);
++ }
++#else
+ hdr.timestamp = cpu_to_le32(mt76_rr(dev, MT_LPON_FRCR(0)));
+ hdr.len = *(__le16 *)data;
+ mt7915_debugfs_write_fwlog(dev, &hdr, sizeof(hdr), data, len);
++#endif
+ }
+
+ bool mt7915_debugfs_rx_log(struct mt7915_dev *dev, const void *data, int len)
+ {
++#ifdef MTK_DEBUG
++ if (get_unaligned_le32(data) != FW_BIN_LOG_MAGIC &&
++ get_unaligned_le32(data) != FW_BIN_LOG_MAGIC_V2 &&
++ get_unaligned_le32(data) != PKT_BIN_DEBUG_MAGIC)
++#else
+ if (get_unaligned_le32(data) != FW_BIN_LOG_MAGIC)
++#endif
+ return false;
+
+ if (dev->relay_fwlog)
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 97a19bdb..0b13375e 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -301,6 +301,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+ __le16 fc = 0;
+ int idx;
+
++#ifdef MTK_DEBUG
++ if (dev->dbg.dump_rx_raw)
++ mt7915_packet_log_to_host(dev, skb->data, skb->len, PKT_BIN_DEBUG_RX_RAW, 0);
++#endif
+ memset(status, 0, sizeof(*status));
+
+ if ((rxd1 & MT_RXD1_NORMAL_BAND_IDX) && !phy->band_idx) {
+@@ -484,6 +488,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+ }
+
+ hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
++#ifdef MTK_DEBUG
++ if (dev->dbg.dump_rx_pkt)
++ mt7915_packet_log_to_host(dev, skb->data, skb->len, PKT_BIN_DEBUG_RX, hdr_gap);
++#endif
+ if (hdr_trans && ieee80211_has_morefrags(fc)) {
+ struct ieee80211_vif *vif;
+ int err;
+@@ -821,6 +829,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ tx_info->buf[1].skip_unmap = true;
+ tx_info->nbuf = MT_CT_DMA_BUF_NUM;
+
++#ifdef MTK_DEBUG
++ if (dev->dbg.dump_txd)
++ mt7915_packet_log_to_host(dev, txwi, MT_TXD_SIZE, PKT_BIN_DEBUG_TXD, 0);
++ if (dev->dbg.dump_tx_pkt)
++ mt7915_packet_log_to_host(dev, t->skb->data, t->skb->len, PKT_BIN_DEBUG_TX, 0);
++#endif
+ return 0;
+ }
+
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 2505fa7e..b6e5f97c 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -58,7 +58,11 @@ int mt7915_run(struct ieee80211_hw *hw)
+ if (ret)
+ goto out;
+
++#ifdef MTK_DEBUG
++ ret = mt7915_mcu_set_sku_en(phy, !dev->dbg.sku_disable);
++#else
+ ret = mt7915_mcu_set_sku_en(phy, true);
++#endif
+ if (ret)
+ goto out;
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 36c21596..5af6de5d 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -199,6 +199,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+ else
+ qid = MT_MCUQ_WM;
+
++#ifdef MTK_DEBUG
++ if (dev->dbg.dump_mcu_pkt)
++ mt7915_packet_log_to_host(dev, skb->data, skb->len, PKT_BIN_DEBUG_MCU, 0);
++#endif
++
+ return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
+ }
+
+@@ -3307,6 +3312,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+ .sku_enable = enable,
+ };
+
++ pr_info("%s: enable = %d\n", __func__, enable);
++
+ return mt76_mcu_send_msg(&dev->mt76,
+ MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
+ sizeof(req), true);
+@@ -3744,6 +3751,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+ &req, sizeof(req), true);
+ }
+
++#ifdef MTK_DEBUG
++int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
++{
++ struct {
++ __le32 args[3];
++ } req = {
++ .args = {
++ cpu_to_le32(a1),
++ cpu_to_le32(a2),
++ cpu_to_le32(a3),
++ },
++ };
++
++ return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
++}
++
++int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
++{
++#define RED_DISABLE 0
++#define RED_BY_HOST_ENABLE 1
++#define RED_BY_WA_ENABLE 2
++ int ret;
++ u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
++ __le32 req = cpu_to_le32(red_type);
++
++ ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
++ sizeof(req), false);
++ if (ret < 0)
++ return ret;
++
++ mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
++ MCU_WA_PARAM_RED, enabled, 0, true);
++
++ return 0;
++}
++#endif
++
+ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+ {
+ struct {
+@@ -3772,3 +3816,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+
+ return 0;
+ }
++
++#ifdef MTK_DEBUG
++int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
++{
++ struct {
++ u16 action;
++ u8 _rsv1[2];
++ u16 wcid;
++ u8 enable;
++ u8 _rsv2[5];
++ } __packed req = {
++ .action = cpu_to_le16(1),
++ .wcid = cpu_to_le16(wcid),
++ .enable = enable,
++ };
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
++}
++#endif
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 46c517e5..b7e8ba2e 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -271,6 +271,10 @@ enum {
+ MCU_WA_PARAM_PDMA_RX = 0x04,
+ MCU_WA_PARAM_CPU_UTIL = 0x0b,
+ MCU_WA_PARAM_RED = 0x0e,
++#ifdef MTK_DEBUG
++ MCU_WA_PARAM_RED_SHOW_STA = 0xf,
++ MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
++#endif
+ };
+
+ enum mcu_mmps_mode {
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 42f21343..2f91020c 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -9,6 +9,7 @@
+ #include "../mt76_connac.h"
+ #include "regs.h"
+
++#define MTK_DEBUG 1
+ #define MT7915_MAX_INTERFACES 19
+ #define MT7915_WTBL_SIZE 288
+ #define MT7916_WTBL_SIZE 544
+@@ -368,6 +369,29 @@ struct mt7915_dev {
+ struct reset_control *rstc;
+ void __iomem *dcm;
+ void __iomem *sku;
++
++#ifdef MTK_DEBUG
++ u16 wlan_idx;
++ struct {
++ u32 fixed_rate;
++ u32 l1debugfs_reg;
++ u32 l2debugfs_reg;
++ u32 mac_reg;
++ u32 fw_dbg_module;
++ u8 fw_dbg_lv;
++ u32 bcn_total_cnt[2];
++ u16 fwlog_seq;
++ bool dump_mcu_pkt;
++ bool dump_txd;
++ bool dump_tx_pkt;
++ bool dump_rx_pkt;
++ bool dump_rx_raw;
++ u32 token_idx;
++ u8 sku_disable;
++ u8 muru_onoff;
++ } dbg;
++ const struct mt7915_dbg_reg_desc *dbg_reg;
++#endif
+ };
+
+ enum {
+@@ -645,4 +669,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ bool pci, int *irq);
+
++#ifdef MTK_DEBUG
++int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
++int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
++int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled);
++void mt7915_dump_tmac_info(u8 *tmac_info);
++int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
++void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
++int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable);
++
++#define PKT_BIN_DEBUG_MAGIC 0xc8763123
++enum {
++ PKT_BIN_DEBUG_MCU,
++ PKT_BIN_DEBUG_TXD,
++ PKT_BIN_DEBUG_TX,
++ PKT_BIN_DEBUG_RX,
++ PKT_BIN_DEBUG_RX_RAW,
++};
++
++#endif
++
+ #endif
+diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
+new file mode 100644
+index 00000000..ecdc02ab
+--- /dev/null
++++ b/mt7915/mt7915_debug.h
+@@ -0,0 +1,1350 @@
++#ifndef __MT7915_DEBUG_H
++#define __MT7915_DEBUG_H
++
++#ifdef MTK_DEBUG
++
++#define DBG_INVALID_BASE 0xffffffff
++#define DBG_INVALID_OFFSET 0x0
++
++struct __dbg_map {
++ u32 phys;
++ u32 maps;
++ u32 size;
++};
++
++struct __dbg_reg {
++ u32 base;
++ u32 offs;
++};
++
++struct __dbg_mask {
++ u32 end;
++ u32 start;
++};
++
++enum dbg_base_rev {
++ MT_DBG_WFDMA0_BASE,
++ MT_DBG_WFDMA1_BASE,
++ MT_DBG_WFDMA0_PCIE1_BASE,
++ MT_DBG_WFDMA1_PCIE1_BASE,
++ MT_DBG_WFDMA_EXT_CSR_BASE,
++ MT_DBG_SWDEF_BASE,
++ __MT_DBG_BASE_REV_MAX,
++};
++
++enum dbg_reg_rev {
++ DBG_INT_SOURCE_CSR,
++ DBG_INT_MASK_CSR,
++ DBG_INT1_SOURCE_CSR,
++ DBG_INT1_MASK_CSR,
++ DBG_TX_RING_BASE,
++ DBG_RX_EVENT_RING_BASE,
++ DBG_RX_STS_RING_BASE,
++ DBG_RX_DATA_RING_BASE,
++ DBG_DMA_ICSC_FR0,
++ DBG_DMA_ICSC_FR1,
++ DBG_TMAC_ICSCR0,
++ DBG_RMAC_RXICSRPT,
++ DBG_MIB_M0SDR0,
++ DBG_MIB_M0SDR3,
++ DBG_MIB_M0SDR4,
++ DBG_MIB_M0SDR5,
++ DBG_MIB_M0SDR7,
++ DBG_MIB_M0SDR8,
++ DBG_MIB_M0SDR9,
++ DBG_MIB_M0SDR10,
++ DBG_MIB_M0SDR11,
++ DBG_MIB_M0SDR12,
++ DBG_MIB_M0SDR14,
++ DBG_MIB_M0SDR15,
++ DBG_MIB_M0SDR16,
++ DBG_MIB_M0SDR17,
++ DBG_MIB_M0SDR18,
++ DBG_MIB_M0SDR19,
++ DBG_MIB_M0SDR20,
++ DBG_MIB_M0SDR21,
++ DBG_MIB_M0SDR22,
++ DBG_MIB_M0SDR23,
++ DBG_MIB_M0DR0,
++ DBG_MIB_M0DR1,
++ DBG_MIB_MUBF,
++ DBG_MIB_M0DR6,
++ DBG_MIB_M0DR7,
++ DBG_MIB_M0DR8,
++ DBG_MIB_M0DR9,
++ DBG_MIB_M0DR10,
++ DBG_MIB_M0DR11,
++ DBG_MIB_M0DR12,
++ DBG_WTBLON_WDUCR,
++ DBG_UWTBL_WDUCR,
++ DBG_PLE_DRR_TABLE_CTRL,
++ DBG_PLE_DRR_TABLE_RDATA,
++ DBG_PLE_PBUF_CTRL,
++ DBG_PLE_QUEUE_EMPTY,
++ DBG_PLE_FREEPG_CNT,
++ DBG_PLE_FREEPG_HEAD_TAIL,
++ DBG_PLE_PG_HIF_GROUP,
++ DBG_PLE_HIF_PG_INFO,
++ DBG_PLE_PG_HIF_TXCMD_GROUP,
++ DBG_PLE_HIF_TXCMD_PG_INFO,
++ DBG_PLE_PG_CPU_GROUP,
++ DBG_PLE_CPU_PG_INFO,
++ DBG_PLE_FL_QUE_CTRL,
++ DBG_PLE_NATIVE_TXCMD_Q_EMPTY,
++ DBG_PLE_TXCMD_Q_EMPTY,
++ DBG_PLE_AC_QEMPTY,
++ DBG_PLE_AC_OFFSET,
++ DBG_PLE_STATION_PAUSE,
++ DBG_PLE_DIS_STA_MAP,
++ DBG_PSE_PBUF_CTRL,
++ DBG_PSE_FREEPG_CNT,
++ DBG_PSE_FREEPG_HEAD_TAIL,
++ DBG_PSE_HIF0_PG_INFO,
++ DBG_PSE_PG_HIF1_GROUP,
++ DBG_PSE_HIF1_PG_INFO,
++ DBG_PSE_PG_CPU_GROUP,
++ DBG_PSE_CPU_PG_INFO,
++ DBG_PSE_PG_PLE_GROUP,
++ DBG_PSE_PLE_PG_INFO,
++ DBG_PSE_PG_LMAC0_GROUP,
++ DBG_PSE_LMAC0_PG_INFO,
++ DBG_PSE_PG_LMAC1_GROUP,
++ DBG_PSE_LMAC1_PG_INFO,
++ DBG_PSE_PG_LMAC2_GROUP,
++ DBG_PSE_LMAC2_PG_INFO,
++ DBG_PSE_PG_LMAC3_GROUP,
++ DBG_PSE_LMAC3_PG_INFO,
++ DBG_PSE_PG_MDP_GROUP,
++ DBG_PSE_MDP_PG_INFO,
++ DBG_PSE_PG_PLE1_GROUP,
++ DBG_PSE_PLE1_PG_INFO,
++ DBG_AGG_AALCR0,
++ DBG_AGG_AALCR1,
++ DBG_AGG_AALCR2,
++ DBG_AGG_AALCR3,
++ DBG_AGG_AALCR4,
++ DBG_AGG_B0BRR0,
++ DBG_AGG_B1BRR0,
++ DBG_AGG_B2BRR0,
++ DBG_AGG_B3BRR0,
++ DBG_AGG_AWSCR0,
++ DBG_AGG_PCR0,
++ DBG_AGG_TTCR0,
++ DBG_MIB_M0ARNG0,
++ DBG_MIB_M0DR2,
++ DBG_MIB_M0DR13,
++ __MT_DBG_REG_REV_MAX,
++};
++
++enum dbg_mask_rev {
++ DBG_MIB_M0SDR10_RX_MDRDY_COUNT,
++ DBG_MIB_M0SDR14_AMPDU,
++ DBG_MIB_M0SDR15_AMPDU_ACKED,
++ DBG_MIB_RX_FCS_ERROR_COUNT,
++ __MT_DBG_MASK_REV_MAX,
++};
++
++enum dbg_bit_rev {
++ __MT_DBG_BIT_REV_MAX,
++};
++
++static const u32 mt7915_dbg_base[] = {
++ [MT_DBG_WFDMA0_BASE] = 0xd4000,
++ [MT_DBG_WFDMA1_BASE] = 0xd5000,
++ [MT_DBG_WFDMA0_PCIE1_BASE] = 0xd8000,
++ [MT_DBG_WFDMA1_PCIE1_BASE] = 0xd9000,
++ [MT_DBG_WFDMA_EXT_CSR_BASE] = 0xd7000,
++ [MT_DBG_SWDEF_BASE] = 0x41f200,
++};
++
++static const u32 mt7916_dbg_base[] = {
++ [MT_DBG_WFDMA0_BASE] = 0xd4000,
++ [MT_DBG_WFDMA1_BASE] = 0xd5000,
++ [MT_DBG_WFDMA0_PCIE1_BASE] = 0xd8000,
++ [MT_DBG_WFDMA1_PCIE1_BASE] = 0xd9000,
++ [MT_DBG_WFDMA_EXT_CSR_BASE] = 0xd7000,
++ [MT_DBG_SWDEF_BASE] = 0x411400,
++};
++
++static const u32 mt7986_dbg_base[] = {
++ [MT_DBG_WFDMA0_BASE] = 0x24000,
++ [MT_DBG_WFDMA1_BASE] = 0x25000,
++ [MT_DBG_WFDMA0_PCIE1_BASE] = 0x28000,
++ [MT_DBG_WFDMA1_PCIE1_BASE] = 0x29000,
++ [MT_DBG_WFDMA_EXT_CSR_BASE] = 0x27000,
++ [MT_DBG_SWDEF_BASE] = 0x411400,
++};
++
++/* mt7915 regs with different base and offset */
++static const struct __dbg_reg mt7915_dbg_reg[] = {
++ [DBG_INT_SOURCE_CSR] = { MT_DBG_WFDMA_EXT_CSR_BASE, 0x10 },
++ [DBG_INT_MASK_CSR] = { MT_DBG_WFDMA_EXT_CSR_BASE, 0x14 },
++ [DBG_INT1_SOURCE_CSR] = { MT_DBG_WFDMA_EXT_CSR_BASE, 0x88 },
++ [DBG_INT1_MASK_CSR] = { MT_DBG_WFDMA_EXT_CSR_BASE, 0x8c },
++ [DBG_TX_RING_BASE] = { MT_DBG_WFDMA1_BASE, 0x400 },
++ [DBG_RX_EVENT_RING_BASE] = { MT_DBG_WFDMA1_BASE, 0x500 },
++ [DBG_RX_STS_RING_BASE] = { MT_DBG_WFDMA1_BASE, 0x510 },
++ [DBG_RX_DATA_RING_BASE] = { MT_DBG_WFDMA0_BASE, 0x500 },
++ [DBG_DMA_ICSC_FR0] = { DBG_INVALID_BASE, 0x0f0 },
++ [DBG_DMA_ICSC_FR1] = { DBG_INVALID_BASE, 0x0f4 },
++ [DBG_TMAC_ICSCR0] = { DBG_INVALID_BASE, 0x200 },
++ [DBG_RMAC_RXICSRPT] = { DBG_INVALID_BASE, 0x618},
++ [DBG_MIB_M0SDR0] = { DBG_INVALID_BASE, 0x010},
++ [DBG_MIB_M0SDR3] = { DBG_INVALID_BASE, 0x014},
++ [DBG_MIB_M0SDR4] = { DBG_INVALID_BASE, 0x018},
++ [DBG_MIB_M0SDR5] = { DBG_INVALID_BASE, 0x01c},
++ [DBG_MIB_M0SDR7] = { DBG_INVALID_BASE, 0x024},
++ [DBG_MIB_M0SDR8] = { DBG_INVALID_BASE, 0x028},
++ [DBG_MIB_M0SDR9] = { DBG_INVALID_BASE, 0x02C},
++ [DBG_MIB_M0SDR10] = { DBG_INVALID_BASE, 0x030},
++ [DBG_MIB_M0SDR11] = { DBG_INVALID_BASE, 0x034},
++ [DBG_MIB_M0SDR12] = { DBG_INVALID_BASE, 0x038},
++ [DBG_MIB_M0SDR14] = { DBG_INVALID_BASE, 0x040},
++ [DBG_MIB_M0SDR15] = { DBG_INVALID_BASE, 0x044},
++ [DBG_MIB_M0SDR16] = { DBG_INVALID_BASE, 0x048},
++ [DBG_MIB_M0SDR17] = { DBG_INVALID_BASE, 0x04c},
++ [DBG_MIB_M0SDR18] = { DBG_INVALID_BASE, 0x050},
++ [DBG_MIB_M0SDR19] = { DBG_INVALID_BASE, 0x054},
++ [DBG_MIB_M0SDR20] = { DBG_INVALID_BASE, 0x058},
++ [DBG_MIB_M0SDR21] = { DBG_INVALID_BASE, 0x05c},
++ [DBG_MIB_M0SDR22] = { DBG_INVALID_BASE, 0x060},
++ [DBG_MIB_M0SDR23] = { DBG_INVALID_BASE, 0x064},
++ [DBG_MIB_M0DR0] = { DBG_INVALID_BASE, 0x0a0},
++ [DBG_MIB_M0DR1] = { DBG_INVALID_BASE, 0x0a4},
++ [DBG_MIB_MUBF] = { DBG_INVALID_BASE, 0x090},
++ [DBG_MIB_M0DR6] = { DBG_INVALID_BASE, 0x0b8},
++ [DBG_MIB_M0DR7] = { DBG_INVALID_BASE, 0x0bc},
++ [DBG_MIB_M0DR8] = { DBG_INVALID_BASE, 0x0c0},
++ [DBG_MIB_M0DR9] = { DBG_INVALID_BASE, 0x0c4},
++ [DBG_MIB_M0DR10] = { DBG_INVALID_BASE, 0x0c8},
++ [DBG_MIB_M0DR11] = { DBG_INVALID_BASE, 0x0cc},
++ [DBG_MIB_M0DR12] = { DBG_INVALID_BASE, 0x160},
++ [DBG_WTBLON_WDUCR] = { DBG_INVALID_BASE, 0x0},
++ [DBG_UWTBL_WDUCR] = { DBG_INVALID_BASE, 0x0},
++ [DBG_PLE_DRR_TABLE_CTRL] = { DBG_INVALID_BASE, 0x388},
++ [DBG_PLE_DRR_TABLE_RDATA] = { DBG_INVALID_BASE, 0x350},
++ [DBG_PLE_PBUF_CTRL] = { DBG_INVALID_BASE, 0x014},
++ [DBG_PLE_QUEUE_EMPTY] = { DBG_INVALID_BASE, 0x0b0},
++ [DBG_PLE_FREEPG_CNT] = { DBG_INVALID_BASE, 0x100},
++ [DBG_PLE_FREEPG_HEAD_TAIL] = { DBG_INVALID_BASE, 0x104},
++ [DBG_PLE_PG_HIF_GROUP] = { DBG_INVALID_BASE, 0x110},
++ [DBG_PLE_HIF_PG_INFO] = { DBG_INVALID_BASE, 0x114},
++ [DBG_PLE_PG_HIF_TXCMD_GROUP] = { DBG_INVALID_BASE, 0x120},
++ [DBG_PLE_HIF_TXCMD_PG_INFO] = { DBG_INVALID_BASE, 0x124},
++ [DBG_PLE_PG_CPU_GROUP] = { DBG_INVALID_BASE, 0x150},
++ [DBG_PLE_CPU_PG_INFO] = { DBG_INVALID_BASE, 0x154},
++ [DBG_PLE_FL_QUE_CTRL] = { DBG_INVALID_BASE, 0x1b0},
++ [DBG_PLE_NATIVE_TXCMD_Q_EMPTY] = { DBG_INVALID_BASE, 0x22c},
++ [DBG_PLE_TXCMD_Q_EMPTY] = { DBG_INVALID_BASE, 0x230},
++ [DBG_PLE_AC_QEMPTY] = { DBG_INVALID_BASE, 0x500},
++ [DBG_PLE_AC_OFFSET] = { DBG_INVALID_BASE, 0x040},
++ [DBG_PLE_STATION_PAUSE] = { DBG_INVALID_BASE, 0x400},
++ [DBG_PLE_DIS_STA_MAP] = { DBG_INVALID_BASE, 0x440},
++ [DBG_PSE_PBUF_CTRL] = { DBG_INVALID_BASE, 0x014},
++ [DBG_PSE_FREEPG_CNT] = { DBG_INVALID_BASE, 0x100},
++ [DBG_PSE_FREEPG_HEAD_TAIL] = { DBG_INVALID_BASE, 0x104},
++ [DBG_PSE_HIF0_PG_INFO] = { DBG_INVALID_BASE, 0x114},
++ [DBG_PSE_PG_HIF1_GROUP] = { DBG_INVALID_BASE, 0x118},
++ [DBG_PSE_HIF1_PG_INFO] = { DBG_INVALID_BASE, 0x11c},
++ [DBG_PSE_PG_CPU_GROUP] = { DBG_INVALID_BASE, 0x150},
++ [DBG_PSE_CPU_PG_INFO] = { DBG_INVALID_BASE, 0x154},
++ [DBG_PSE_PG_PLE_GROUP] = { DBG_INVALID_BASE, 0x160},
++ [DBG_PSE_PLE_PG_INFO] = { DBG_INVALID_BASE, 0x164},
++ [DBG_PSE_PG_LMAC0_GROUP] = { DBG_INVALID_BASE, 0x170},
++ [DBG_PSE_LMAC0_PG_INFO] = { DBG_INVALID_BASE, 0x174},
++ [DBG_PSE_PG_LMAC1_GROUP] = { DBG_INVALID_BASE, 0x178},
++ [DBG_PSE_LMAC1_PG_INFO] = { DBG_INVALID_BASE, 0x17c},
++ [DBG_PSE_PG_LMAC2_GROUP] = { DBG_INVALID_BASE, 0x180},
++ [DBG_PSE_LMAC2_PG_INFO] = { DBG_INVALID_BASE, 0x184},
++ [DBG_PSE_PG_LMAC3_GROUP] = { DBG_INVALID_BASE, 0x188},
++ [DBG_PSE_LMAC3_PG_INFO] = { DBG_INVALID_BASE, 0x18c},
++ [DBG_PSE_PG_MDP_GROUP] = { DBG_INVALID_BASE, 0x198},
++ [DBG_PSE_MDP_PG_INFO] = { DBG_INVALID_BASE, 0x19c},
++ [DBG_PSE_PG_PLE1_GROUP] = { DBG_INVALID_BASE, 0x168},
++ [DBG_PSE_PLE1_PG_INFO] = { DBG_INVALID_BASE, 0x16c},
++ [DBG_AGG_AALCR0] = { DBG_INVALID_BASE, 0x048},
++ [DBG_AGG_AALCR1] = { DBG_INVALID_BASE, 0x04c},
++ [DBG_AGG_AALCR2] = { DBG_INVALID_BASE, 0x050},
++ [DBG_AGG_AALCR3] = { DBG_INVALID_BASE, 0x054},
++ [DBG_AGG_AALCR4] = { DBG_INVALID_BASE, 0x058},
++ [DBG_AGG_B0BRR0] = { DBG_INVALID_BASE, 0x100},
++ [DBG_AGG_B1BRR0] = { DBG_INVALID_BASE, 0x104},
++ [DBG_AGG_B2BRR0] = { DBG_INVALID_BASE, 0x108},
++ [DBG_AGG_B3BRR0] = { DBG_INVALID_BASE, 0x10c},
++ [DBG_AGG_AWSCR0] = { DBG_INVALID_BASE, 0x030},
++ [DBG_AGG_PCR0] = { DBG_INVALID_BASE, 0x040},
++ [DBG_AGG_TTCR0] = { DBG_INVALID_BASE, 0x04c},
++ [DBG_MIB_M0ARNG0] = { DBG_INVALID_BASE, 0x4b8},
++ [DBG_MIB_M0DR2] = { DBG_INVALID_BASE, 0x0a8},
++ [DBG_MIB_M0DR13] = { DBG_INVALID_BASE, 0x164},
++};
++
++/* mt7986/mt7916 regs with different base and offset */
++static const struct __dbg_reg mt7916_dbg_reg[] = {
++ [DBG_INT_SOURCE_CSR] = { MT_DBG_WFDMA0_BASE, 0x200 },
++ [DBG_INT_MASK_CSR] = { MT_DBG_WFDMA0_BASE, 0x204 },
++ [DBG_INT1_SOURCE_CSR] = { MT_DBG_WFDMA0_PCIE1_BASE, 0x200 },
++ [DBG_INT1_MASK_CSR] = { MT_DBG_WFDMA0_PCIE1_BASE, 0x204 },
++ [DBG_TX_RING_BASE] = { MT_DBG_WFDMA0_BASE, 0x400 },
++ [DBG_RX_EVENT_RING_BASE] = { MT_DBG_WFDMA0_BASE, 0x500 },
++ [DBG_RX_STS_RING_BASE] = { MT_DBG_WFDMA0_BASE, 0x520 },
++ [DBG_RX_DATA_RING_BASE] = { MT_DBG_WFDMA0_BASE, 0x540 },
++ [DBG_DMA_ICSC_FR0] = { DBG_INVALID_BASE, 0x05c },
++ [DBG_DMA_ICSC_FR1] = { DBG_INVALID_BASE, 0x060 },
++ [DBG_TMAC_ICSCR0] = { DBG_INVALID_BASE, 0x120 },
++ [DBG_RMAC_RXICSRPT] = { DBG_INVALID_BASE, 0xd0 },
++ [DBG_MIB_M0SDR0] = { DBG_INVALID_BASE, 0x7d8},
++ [DBG_MIB_M0SDR3] = { DBG_INVALID_BASE, 0x698},
++ [DBG_MIB_M0SDR4] = { DBG_INVALID_BASE, 0x788},
++ [DBG_MIB_M0SDR5] = { DBG_INVALID_BASE, 0x780},
++ [DBG_MIB_M0SDR7] = { DBG_INVALID_BASE, 0x5a8},
++ [DBG_MIB_M0SDR8] = { DBG_INVALID_BASE, 0x78c},
++ [DBG_MIB_M0SDR9] = { DBG_INVALID_BASE, 0x024},
++ [DBG_MIB_M0SDR10] = { DBG_INVALID_BASE, 0x76c},
++ [DBG_MIB_M0SDR11] = { DBG_INVALID_BASE, 0x790},
++ [DBG_MIB_M0SDR12] = { DBG_INVALID_BASE, 0x558},
++ [DBG_MIB_M0SDR14] = { DBG_INVALID_BASE, 0x564},
++ [DBG_MIB_M0SDR15] = { DBG_INVALID_BASE, 0x564},
++ [DBG_MIB_M0SDR16] = { DBG_INVALID_BASE, 0x7fc},
++ [DBG_MIB_M0SDR17] = { DBG_INVALID_BASE, 0x800},
++ [DBG_MIB_M0SDR18] = { DBG_INVALID_BASE, 0x030},
++ [DBG_MIB_M0SDR19] = { DBG_INVALID_BASE, 0x5ac},
++ [DBG_MIB_M0SDR20] = { DBG_INVALID_BASE, 0x5b0},
++ [DBG_MIB_M0SDR21] = { DBG_INVALID_BASE, 0x5b4},
++ [DBG_MIB_M0SDR22] = { DBG_INVALID_BASE, 0x770},
++ [DBG_MIB_M0SDR23] = { DBG_INVALID_BASE, 0x774},
++ [DBG_MIB_M0DR0] = { DBG_INVALID_BASE, 0x594},
++ [DBG_MIB_M0DR1] = { DBG_INVALID_BASE, 0x598},
++ [DBG_MIB_MUBF] = { DBG_INVALID_BASE, 0x7ac},
++ [DBG_MIB_M0DR6] = { DBG_INVALID_BASE, 0x658},
++ [DBG_MIB_M0DR7] = { DBG_INVALID_BASE, 0x65c},
++ [DBG_MIB_M0DR8] = { DBG_INVALID_BASE, 0x56c},
++ [DBG_MIB_M0DR9] = { DBG_INVALID_BASE, 0x570},
++ [DBG_MIB_M0DR10] = { DBG_INVALID_BASE, 0x578},
++ [DBG_MIB_M0DR11] = { DBG_INVALID_BASE, 0x574},
++ [DBG_MIB_M0DR12] = { DBG_INVALID_BASE, 0x654},
++ [DBG_WTBLON_WDUCR] = { DBG_INVALID_BASE, 0x200},
++ [DBG_UWTBL_WDUCR] = { DBG_INVALID_BASE, 0x094},
++ [DBG_PLE_DRR_TABLE_CTRL] = { DBG_INVALID_BASE, 0x490},
++ [DBG_PLE_DRR_TABLE_RDATA] = { DBG_INVALID_BASE, 0x470},
++ [DBG_PLE_PBUF_CTRL] = { DBG_INVALID_BASE, 0x004},
++ [DBG_PLE_QUEUE_EMPTY] = { DBG_INVALID_BASE, 0x360},
++ [DBG_PLE_FREEPG_CNT] = { DBG_INVALID_BASE, 0x380},
++ [DBG_PLE_FREEPG_HEAD_TAIL] = { DBG_INVALID_BASE, 0x384},
++ [DBG_PLE_PG_HIF_GROUP] = { DBG_INVALID_BASE, 0x00c},
++ [DBG_PLE_HIF_PG_INFO] = { DBG_INVALID_BASE, 0x388},
++ [DBG_PLE_PG_HIF_TXCMD_GROUP] = { DBG_INVALID_BASE, 0x014},
++ [DBG_PLE_HIF_TXCMD_PG_INFO] = { DBG_INVALID_BASE, 0x390},
++ [DBG_PLE_PG_CPU_GROUP] = { DBG_INVALID_BASE, 0x018},
++ [DBG_PLE_CPU_PG_INFO] = { DBG_INVALID_BASE, 0x394},
++ [DBG_PLE_FL_QUE_CTRL] = { DBG_INVALID_BASE, 0x3e0},
++ [DBG_PLE_NATIVE_TXCMD_Q_EMPTY] = { DBG_INVALID_BASE, 0x370},
++ [DBG_PLE_TXCMD_Q_EMPTY] = { DBG_INVALID_BASE, 0x36c},
++ [DBG_PLE_AC_QEMPTY] = { DBG_INVALID_BASE, 0x600},
++ [DBG_PLE_AC_OFFSET] = { DBG_INVALID_BASE, 0x080},
++ [DBG_PLE_STATION_PAUSE] = { DBG_INVALID_BASE, 0x100},
++ [DBG_PLE_DIS_STA_MAP] = { DBG_INVALID_BASE, 0x180},
++ [DBG_PSE_PBUF_CTRL] = { DBG_INVALID_BASE, 0x004},
++ [DBG_PSE_FREEPG_CNT] = { DBG_INVALID_BASE, 0x380},
++ [DBG_PSE_FREEPG_HEAD_TAIL] = { DBG_INVALID_BASE, 0x384},
++ [DBG_PSE_HIF0_PG_INFO] = { DBG_INVALID_BASE, 0x150},
++ [DBG_PSE_PG_HIF1_GROUP] = { DBG_INVALID_BASE, 0x154},
++ [DBG_PSE_HIF1_PG_INFO] = { DBG_INVALID_BASE, 0x160},
++ [DBG_PSE_PG_CPU_GROUP] = { DBG_INVALID_BASE, 0x118},
++ [DBG_PSE_CPU_PG_INFO] = { DBG_INVALID_BASE, 0x158},
++ [DBG_PSE_PG_PLE_GROUP] = { DBG_INVALID_BASE, 0x11c},
++ [DBG_PSE_PLE_PG_INFO] = { DBG_INVALID_BASE, 0x15c},
++ [DBG_PSE_PG_LMAC0_GROUP] = { DBG_INVALID_BASE, 0x124},
++ [DBG_PSE_LMAC0_PG_INFO] = { DBG_INVALID_BASE, 0x164},
++ [DBG_PSE_PG_LMAC1_GROUP] = { DBG_INVALID_BASE, 0x128},
++ [DBG_PSE_LMAC1_PG_INFO] = { DBG_INVALID_BASE, 0x168},
++ [DBG_PSE_PG_LMAC2_GROUP] = { DBG_INVALID_BASE, 0x12c},
++ [DBG_PSE_LMAC2_PG_INFO] = { DBG_INVALID_BASE, 0x16c},
++ [DBG_PSE_PG_LMAC3_GROUP] = { DBG_INVALID_BASE, 0x130},
++ [DBG_PSE_LMAC3_PG_INFO] = { DBG_INVALID_BASE, 0x17c},
++ [DBG_PSE_PG_MDP_GROUP] = { DBG_INVALID_BASE, 0x134},
++ [DBG_PSE_MDP_PG_INFO] = { DBG_INVALID_BASE, 0x174},
++ [DBG_PSE_PG_PLE1_GROUP] = { DBG_INVALID_BASE, 0x120},
++ [DBG_PSE_PLE1_PG_INFO] = { DBG_INVALID_BASE, 0x160},
++ [DBG_AGG_AALCR0] = { DBG_INVALID_BASE, 0x028},
++ [DBG_AGG_AALCR1] = { DBG_INVALID_BASE, 0x144},
++ [DBG_AGG_AALCR2] = { DBG_INVALID_BASE, 0x14c},
++ [DBG_AGG_AALCR3] = { DBG_INVALID_BASE, 0x154},
++ [DBG_AGG_AALCR4] = { DBG_INVALID_BASE, 0x02c},
++ [DBG_AGG_B0BRR0] = { DBG_INVALID_BASE, 0x08c},
++ [DBG_AGG_B1BRR0] = { DBG_INVALID_BASE, 0x148},
++ [DBG_AGG_B2BRR0] = { DBG_INVALID_BASE, 0x150},
++ [DBG_AGG_B3BRR0] = { DBG_INVALID_BASE, 0x158},
++ [DBG_AGG_AWSCR0] = { DBG_INVALID_BASE, 0x05c},
++ [DBG_AGG_PCR0] = { DBG_INVALID_BASE, 0x06c},
++ [DBG_AGG_TTCR0] = { DBG_INVALID_BASE, 0x07c},
++ [DBG_MIB_M0ARNG0] = { DBG_INVALID_BASE, 0x0b0},
++ [DBG_MIB_M0DR2] = { DBG_INVALID_BASE, 0x7dc},
++ [DBG_MIB_M0DR13] = { DBG_INVALID_BASE, 0x7ec},
++};
++
++static const struct __dbg_mask mt7915_dbg_mask[] = {
++ [DBG_MIB_M0SDR10_RX_MDRDY_COUNT]= {25, 0},
++ [DBG_MIB_M0SDR14_AMPDU] = {23, 0},
++ [DBG_MIB_M0SDR15_AMPDU_ACKED] = {23, 0},
++ [DBG_MIB_RX_FCS_ERROR_COUNT] = {15, 0},
++};
++
++static const struct __dbg_mask mt7916_dbg_mask[] = {
++ [DBG_MIB_M0SDR10_RX_MDRDY_COUNT]= {31, 0},
++ [DBG_MIB_M0SDR14_AMPDU] = {31, 0},
++ [DBG_MIB_M0SDR15_AMPDU_ACKED] = {31, 0},
++ [DBG_MIB_RX_FCS_ERROR_COUNT] = {31, 16},
++};
++
++/* used to differentiate between generations */
++struct mt7915_dbg_reg_desc {
++ const u32 id;
++ const u32 *base_rev;
++ const struct __dbg_reg *reg_rev;
++ const struct __dbg_mask *mask_rev;
++};
++
++static const struct mt7915_dbg_reg_desc dbg_reg_s[] = {
++ { 0x7915,
++ mt7915_dbg_base,
++ mt7915_dbg_reg,
++ mt7915_dbg_mask
++ },
++ { 0x7906,
++ mt7916_dbg_base,
++ mt7916_dbg_reg,
++ mt7916_dbg_mask
++ },
++ { 0x7986,
++ mt7986_dbg_base,
++ mt7916_dbg_reg,
++ mt7916_dbg_mask
++ },
++};
++
++struct bin_debug_hdr {
++ __le32 magic_num;
++ __le16 serial_id;
++ __le16 msg_type;
++ __le16 len;
++ __le16 des_len; /* descriptor len for rxd */
++} __packed;
++
++#define __DBG_REG_MAP(_dev, id, ofs) ((_dev)->dbg_reg->base_rev[(id)] + (ofs))
++#define __DBG_REG_BASE(_dev, id) ((_dev)->dbg_reg->reg_rev[(id)].base)
++#define __DBG_REG_OFFS(_dev, id) ((_dev)->dbg_reg->reg_rev[(id)].offs)
++
++#define __DBG_MASK(_dev, id) GENMASK((_dev)->dbg_reg->mask_rev[(id)].end, \
++ (_dev)->dbg_reg->mask_rev[(id)].start)
++#define __DBG_REG(_dev, id) __DBG_REG_MAP((_dev), __DBG_REG_BASE((_dev), (id)), \
++ __DBG_REG_OFFS((_dev), (id)))
++
++#define __DBG_FIELD_GET(id, _reg) (((_reg) & __DBG_MASK(dev, (id))) >> \
++ dev->dbg_reg->mask_rev[(id)].start)
++#define __DBG_FIELD_PREP(id, _reg) (((_reg) << dev->dbg_reg->mask_rev[(id)].start) & \
++ __DBG_MASK(dev, (id)))
++
++
++#define MT_DBG_TX_RING_BASE __DBG_REG(dev, DBG_TX_RING_BASE)
++#define MT_DBG_RX_EVENT_RING_BASE __DBG_REG(dev, DBG_RX_EVENT_RING_BASE)
++#define MT_DBG_RX_STS_RING_BASE __DBG_REG(dev, DBG_RX_STS_RING_BASE)
++#define MT_DBG_RX_DATA_RING_BASE __DBG_REG(dev, DBG_RX_DATA_RING_BASE)
++
++#define MT_DBG_TX_RING_CTRL(n) (MT_DBG_TX_RING_BASE + (0x10 * (n)))
++#define MT_DBG_RX_DATA_RING_CTRL(n) (MT_DBG_RX_DATA_RING_BASE + (0x10 * (n)))
++#define MT_DBG_RX_EVENT_RING_CTRL(n) (MT_DBG_RX_EVENT_RING_BASE + (0x10 * (n)))
++
++/* WFDMA COMMON */
++#define MT_DBG_INT_SOURCE_CSR __DBG_REG(dev, DBG_INT_SOURCE_CSR)
++#define MT_DBG_INT_MASK_CSR __DBG_REG(dev, DBG_INT_MASK_CSR)
++#define MT_DBG_INT1_SOURCE_CSR __DBG_REG(dev, DBG_INT1_SOURCE_CSR)
++#define MT_DBG_INT1_MASK_CSR __DBG_REG(dev, DBG_INT1_MASK_CSR)
++
++/* WFDMA0 */
++#define MT_DBG_WFDMA0(_ofs) __DBG_REG_MAP(dev, MT_DBG_WFDMA0_BASE, (_ofs))
++
++#define MT_DBG_WFDMA0_INT_SOURCE_CSR MT_DBG_WFDMA0(0x200)
++#define MT_DBG_WFDMA0_INT_MASK_CSR MT_DBG_WFDMA0(0x204)
++
++#define MT_DBG_WFDMA0_GLO_CFG MT_DBG_WFDMA0(0x208)
++#define MT_DBG_WFDMA0_GLO_CFG_TX_DMA_EN BIT(0)
++#define MT_DBG_WFDMA0_GLO_CFG_RX_DMA_EN BIT(2)
++#define MT_DBG_WFDMA0_GLO_CFG_TX_BUSY_MASK BIT(1)
++#define MT_DBG_WFDMA0_GLO_CFG_RX_BUSY_MASK BIT(3)
++
++
++/* WFDMA1 */
++#define MT_DBG_WFDMA1(_ofs) __DBG_REG_MAP(dev, MT_DBG_WFDMA1_BASE, (_ofs))
++#define MT_DBG_WFDMA1_INT_SOURCE_CSR MT_DBG_WFDMA1(0x200)
++#define MT_DBG_WFDMA1_INT_MASK_CSR MT_DBG_WFDMA1(0x204)
++
++#define MT_DBG_WFDMA1_GLO_CFG MT_DBG_WFDMA1(0x208)
++
++#define MT_DBG_WFDMA1_GLO_CFG_TX_DMA_EN BIT(0)
++#define MT_DBG_WFDMA1_GLO_CFG_RX_DMA_EN BIT(2)
++#define MT_DBG_WFDMA1_GLO_CFG_TX_BUSY_MASK BIT(1)
++#define MT_DBG_WFDMA1_GLO_CFG_RX_BUSY_MASK BIT(3)
++
++/* WFDMA0 PCIE1 */
++#define MT_DBG_WFDMA0_PCIE1(_ofs) __DBG_REG_MAP(dev, MT_DBG_WFDMA0_PCIE1_BASE, (_ofs))
++
++#define MT_DBG_WFDMA0_PCIE1_INT_SOURCE_CSR MT_DBG_WFDMA0_PCIE1(0x200)
++#define MT_DBG_WFDMA0_PCIE1_INT_MASK_CSR MT_DBG_WFDMA0_PCIE1(0x204)
++#define MT_DBG_WFDMA0_PCIE1_GLO_CFG MT_DBG_WFDMA0_PCIE1(0x208)
++#define MT_DBG_WFDMA0_PCIE1_RX1_CTRL0 MT_DBG_WFDMA1_PCIE1(0x510)
++
++#define MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_DMA_EN BIT(0)
++#define MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_BUSY_MASK BIT(1)
++#define MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_DMA_EN BIT(2)
++#define MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_BUSY_MASK BIT(3)
++
++/* WFDMA1 PCIE1 */
++#define MT_DBG_WFDMA1_PCIE1(_ofs) __DBG_REG_MAP(dev, MT_DBG_WFDMA1_PCIE1_BASE, (_ofs))
++#define MT_DBG_WFDMA1_PCIE1_INT_SOURCE_CSR MT_DBG_WFDMA1_PCIE1(0x200)
++#define MT_DBG_WFDMA1_PCIE1_INT_MASK_CSR MT_DBG_WFDMA1_PCIE1(0x204)
++#define MT_DBG_WFDMA1_PCIE1_GLO_CFG MT_DBG_WFDMA1_PCIE1(0x208)
++#define MT_DBG_WFDMA1_PCIE1_TX19_CTRL0 MT_DBG_WFDMA1_PCIE1(0x330)
++#define MT_DBG_WFDMA1_PCIE1_RX2_CTRL0 MT_DBG_WFDMA1_PCIE1(0x520)
++
++#define MT_DBG_WFDMA1_PCIE1_GLO_CFG_TX_DMA_EN BIT(0)
++#define MT_DBG_WFDMA1_PCIE1_GLO_CFG_TX_BUSY_MASK BIT(1)
++#define MT_DBG_WFDMA1_PCIE1_GLO_CFG_RX_DMA_EN BIT(2)
++#define MT_DBG_WFDMA1_PCIE1_GLO_CFG_RX_BUSY_MASK BIT(3)
++
++#define MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_RX_DMA_EN_MASK BIT(2)
++#define MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_TX_DMA_EN_MASK BIT(0)
++#define MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_RX_DMA_BUSY_MASK BIT(3)
++#define MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_TX_DMA_BUSY_MASK BIT(1)
++
++
++/* WF DMA TOP: band 0(0x820E7000),band 1(0x820F7000) */
++#define MT_DBG_WF_DMA_BASE(_band) ((_band) ? 0x820F7000 : 0x820E7000)
++#define MT_DBG_WF_DMA(_band, ofs) (MT_WF_DMA_BASE(_band) + (ofs))
++
++#define MT_DBG_DMA_DCR0(_band) MT_DBG_WF_DMA((_band), 0x000)
++#define MT_DBG_DMA_DCR0_MAX_RX_LEN GENMASK(15, 3)
++#define MT_DBG_DMA_DCR0_RXD_G5_EN BIT(23)
++
++#define MT_DBG_DMA_ICSC_FR0(_band) MT_DBG_WF_DMA((_band), __DBG_REG_OFFS(dev, DBG_DMA_ICSC_FR0))
++#define MT_DBG_DMA_ICSC_FR0_RXBF_EN BIT(25)
++#define MT_DBG_DMA_ICSC_FR0_EN BIT(24)
++#define MT_DBG_DMA_ICSC_FR0_TOUT_MASK GENMASK(23, 16)
++#define MT_DBG_DMA_ICSC_FR0_PID_MASK GENMASK(9, 8)
++#define MT_DBG_DMA_ICSC_FR0_QID_MASK GENMASK(6, 0)
++
++#define MT_DBG_DMA_ICSC_FR1(_band) MT_DBG_WF_DMA((_band), __DBG_REG_OFFS(dev, DBG_DMA_ICSC_FR1))
++#define MT_DBG_DMA_ICSC_FR1_AGG_SIZE_MASK GENMASK(26, 16)
++#define MT_DBG_DMA_ICSC_FR1_MAX_FRAME_SIZE_MASK GENMASK(10, 0)
++
++/* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
++#define MT_DBG_WF_TMAC_BASE(_band) ((_band) ? 0x820f4000 : 0x820e4000)
++#define MT_DBG_WF_TMAC(_band, ofs) (MT_DBG_WF_TMAC_BASE(_band) + (ofs))
++
++#define MT_DBG_TMAC_ICSCR0(_band) MT_DBG_WF_TMAC((_band), __DBG_REG_OFFS(dev, DBG_TMAC_ICSCR0))
++#define MT_DBG_TMAC_ICSCR0_ICSRPT_EN BIT(0)
++
++/* RMAC: band 0(0x820E5000), band 1(0x820f5000) */
++#define MT_DBG_WF_RMAC_BASE(_band) ((_band) ? 0x820f5000 : 0x820E5000)
++#define MT_DBG_WF_RMAC(_band, ofs) (MT_DBG_WF_RMAC_BASE(_band) + (ofs))
++
++#define MT_DBG_RMAC_RXICSRPT(_band) MT_DBG_WF_RMAC((_band), __DBG_REG_OFFS(dev, DBG_RMAC_RXICSRPT))
++#define MT_DBG_RMAC_RXICSRPT_ICSRPT_EN BIT(0)
++
++/* MIB: band 0(0x820ed000), band 1(0x820fd000) */
++#define MT_DBG_MIB_BASE(_band) ((_band) ? 0x820fd000 : 0x820ed000)
++#define MT_DBG_MIB(_band, ofs) (MT_DBG_MIB_BASE(_band) + (ofs))
++
++
++#define MT_DBG_MIB_M0SCR0(_band) MT_DBG_MIB((_band), 0x00)
++#define MT_DBG_MIB_M0PBSCR(_band) MT_DBG_MIB((_band), 0x04)
++
++#define MT_DBG_MIB_M0SDR0(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR0))
++#define MT_DBG_MIB_M0SDR3(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR3))
++#define MT_DBG_MIB_RX_FCS_ERROR_COUNT_MASK __DBG_MASK(dev, DBG_MIB_RX_FCS_ERROR_COUNT)
++#define MT_DBG_MIB_M0SDR4(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR4))
++#define MT_DBG_MIB_M0SDR5(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR5))
++#define MT_DBG_MIB_M0SDR6(_band) MT_DBG_MIB((_band), 0x20)
++#define MT_DBG_MIB_M0SDR7(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR7))
++#define MT_DBG_MIB_M0SDR8(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR8))
++#define MT_DBG_MIB_M0SDR9(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR9))
++#define MT_DBG_MIB_M0SDR10(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR10))
++#define MT_DBG_MIB_M0SDR10_RX_MDRDY_COUNT_MASK __DBG_MASK(dev, DBG_MIB_M0SDR10_RX_MDRDY_COUNT)
++#define MT_DBG_MIB_M0SDR11(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR11))
++
++#define MT_DBG_MIB_M0SDR12(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR12))
++
++#define MT_DBG_MIB_M0SDR14(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR14))
++#define MT_DBG_MIB_M0SDR14_AMPDU_MASK __DBG_MASK(dev, DBG_MIB_M0SDR14_AMPDU)
++#define MT_DBG_MIB_M0SDR15(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR15))
++#define MT_DBG_MIB_M0SDR15_AMPDU_ACKED_MASK __DBG_MASK(dev, DBG_MIB_M0SDR15_AMPDU_ACKED)
++#define MT_DBG_MIB_M0SDR16(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR16))
++#define MT_DBG_MIB_M0SDR17(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR17))
++#define MT_DBG_MIB_M0SDR18(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR18))
++#define MT_DBG_MIB_M0SDR19(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR19))
++#define MT_DBG_MIB_M0SDR20(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR20))
++#define MT_DBG_MIB_M0SDR21(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR21))
++#define MT_DBG_MIB_M0SDR22(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR22))
++#define MT_DBG_MIB_M0SDR23(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR23))
++#define MT_DBG_MIB_M0DR0(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR0))
++#define MT_DBG_MIB_M0DR1(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR1))
++
++#define MT_DBG_MIB_MUBF(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_MUBF))
++#define MT_DBG_MIB_M0DR6(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR6))
++#define MT_DBG_MIB_M0DR7(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR7))
++#define MT_DBG_MIB_M0DR8(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR8))
++#define MT_DBG_MIB_M0DR9(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR9))
++#define MT_DBG_MIB_M0DR10(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR10))
++#define MT_DBG_MIB_M0DR11(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR11))
++ #define MT_DBG_MIB_M0DR12(_band) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR12))
++
++/* WTBLON TOP: 0x820D4000/pcie(0x34000) rbus(0x434000) */
++#define MT_DBG_WTBLON_TOP_BASE 0x820D4000
++#define MT_DBG_WTBLON_TOP(ofs) (MT_WTBLON_TOP_BASE + (ofs))
++#define MT_DBG_WTBLON_TOP_WDUCR MT_DBG_WTBLON_TOP(__DBG_REG_OFFS(dev, DBG_WTBLON_WDUCR))
++#define MT_DBG_WTBLON_TOP_WDUCR_GROUP GENMASK(2, 0)
++
++#define WF_WTBLON_TOP_B0BTCRn_ADDR (MT_DBG_WTBLON_TOP_BASE + 0x1000) // 5000
++#define WF_WTBLON_TOP_B0BTBCRn_ADDR (MT_DBG_WTBLON_TOP_BASE + 0x1010) // 5010
++#define WF_WTBLON_TOP_B0BRCRn_ADDR (MT_DBG_WTBLON_TOP_BASE + 0x1020) // 5020
++#define WF_WTBLON_TOP_B0BRBCRn_ADDR (MT_DBG_WTBLON_TOP_BASE + 0x1030) // 5030
++#define WF_WTBLON_TOP_B0BTDCRn_ADDR (MT_DBG_WTBLON_TOP_BASE + 0x1040) // 5040
++#define WF_WTBLON_TOP_B0BRDCRn_ADDR (MT_DBG_WTBLON_TOP_BASE + 0x1050) // 5050
++#define WF_WTBLON_TOP_B0MBTCRn_ADDR (MT_DBG_WTBLON_TOP_BASE + 0x1100) // 5100
++#define WF_WTBLON_TOP_B0MBTBCRn_ADDR (MT_DBG_WTBLON_TOP_BASE + 0x1140) // 5140
++#define WF_WTBLON_TOP_B0MBRCRn_ADDR (MT_DBG_WTBLON_TOP_BASE + 0x1180) // 5180
++#define WF_WTBLON_TOP_B0MBRBCRn_ADDR (MT_DBG_WTBLON_TOP_BASE + 0x11C0) // 51C0
++
++#define WF_WTBLON_TOP_B1BTCRn_ADDR (MT_DBG_WTBLON_TOP_BASE + 0x1800) // 5800
++
++/* WTBLON TOP: 0x820C4000/pcie(0xa8000) rbus(0x4a8000) */
++#define MT_DBG_UWTBL_TOP_BASE 0x820C4000
++#define MT_DBG_UWTBL_TOP(ofs) (MT_DBG_UWTBL_TOP_BASE + (ofs))
++
++#define MT_DBG_UWTBL_TOP_WDUCR MT_DBG_UWTBL_TOP(__DBG_REG_OFFS(dev, DBG_UWTBL_WDUCR))
++
++#define MT_UWTBL_TOP_WDUCR_TARGET BIT(31)
++#define MT_UWTBL_TOP_WDUCR_GROUP GENMASK(3, 0)
++
++
++/* WTBL : 0x820D8000/pcie(0x38000) rbus(0x438000) */
++#define MT_DBG_WTBL_BASE 0x820D8000
++
++/* PLE related CRs. */
++#define MT_DBG_PLE_BASE 0x820C0000
++#define MT_DBG_PLE(ofs) (MT_DBG_PLE_BASE + (ofs))
++
++#define MT_DBG_PLE_DRR_TAB_CTRL MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_DRR_TABLE_CTRL))
++#define MT_DBG_PLE_DRR_TAB_RD_OFS __DBG_REG_OFFS(dev, DBG_PLE_DRR_TABLE_RDATA)
++
++#define MT_DBG_PLE_DRR_TABLE_RDATA0 MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x0)
++#define MT_DBG_PLE_DRR_TABLE_RDATA1 MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x4)
++#define MT_DBG_PLE_DRR_TABLE_RDATA2 MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x8)
++#define MT_DBG_PLE_DRR_TABLE_RDATA3 MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0xc)
++#define MT_DBG_PLE_DRR_TABLE_RDATA4 MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x10)
++#define MT_DBG_PLE_DRR_TABLE_RDATA5 MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x14)
++#define MT_DBG_PLE_DRR_TABLE_RDATA6 MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x18)
++#define MT_DBG_PLE_DRR_TABLE_RDATA7 MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS+ 0x1c)
++
++#define MT_DBG_PLE_PBUF_CTRL_ADDR MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_PBUF_CTRL))
++#define MT_DBG_PLE_QUEUE_EMPTY MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_QUEUE_EMPTY))
++#define MT_DBG_PLE_FREEPG_CNT MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_FREEPG_CNT))
++#define MT_DBG_PLE_FREEPG_HEAD_TAIL MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_FREEPG_HEAD_TAIL))
++#define MT_DBG_PLE_PG_HIF_GROUP MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_PG_HIF_GROUP))
++#define MT_DBG_PLE_HIF_PG_INFO MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_HIF_PG_INFO))
++#define MT_DBG_PLE_PG_HIF_TXCMD_GROUP MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_PG_HIF_TXCMD_GROUP))
++#define MT_DBG_PLE_HIF_TXCMD_PG_INFO MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_HIF_TXCMD_PG_INFO))
++#define MT_DBG_PLE_PG_CPU_GROUP MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_PG_CPU_GROUP))
++#define MT_DBG_PLE_CPU_PG_INFO MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_CPU_PG_INFO))
++#define PLE_FL_QUE_CTRL_OFFSET __DBG_REG_OFFS(dev, DBG_PLE_FL_QUE_CTRL)
++#define MT_DBG_PLE_FL_QUE_CTRL0 MT_DBG_PLE(PLE_FL_QUE_CTRL_OFFSET + 0x0)
++#define MT_DBG_PLE_FL_QUE_CTRL1 MT_DBG_PLE(PLE_FL_QUE_CTRL_OFFSET + 0x4)
++#define MT_DBG_PLE_FL_QUE_CTRL2 MT_DBG_PLE(PLE_FL_QUE_CTRL_OFFSET + 0x8)
++#define MT_DBG_PLE_FL_QUE_CTRL3 MT_DBG_PLE(PLE_FL_QUE_CTRL_OFFSET + 0xc)
++#define MT_DBG_PLE_NATIVE_TXCMD_Q_EMPTY MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_NATIVE_TXCMD_Q_EMPTY))
++#define MT_DBG_PLE_TXCMD_Q_EMPTY MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_TXCMD_Q_EMPTY))
++
++#define MT_DBG_PLE_PBUF_CTRL_PAGE_SIZE_MASK BIT(31)
++#define MT_DBG_PLE_PBUF_CTRL_OFFSET_MASK GENMASK(25, 17)
++#define MT_DBG_PLE_PBUF_CTRL_TOTAL_PAGE_NUM_MASK GENMASK(11, 0)
++
++#define MT_DBG_PLE_FREEPG_CNT_FREEPG_CNT_MASK GENMASK(11, 0)
++#define MT_DBG_PLE_FREEPG_CNT_FFA_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PLE_FREEPG_HEAD_TAIL_FREEPG_TAIL_MASK GENMASK(27, 16)
++#define MT_DBG_PLE_FREEPG_HEAD_TAIL_FREEPG_HEAD_MASK GENMASK(11, 0)
++#define MT_DBG_PLE_PG_HIF_GROUP_HIF_MAX_QUOTA_MASK GENMASK(27, 16)
++#define MT_DBG_PLE_PG_HIF_GROUP_HIF_MIN_QUOTA_MASK GENMASK(11, 0)
++
++#define MT_DBG_PLE_HIF_PG_INFO_HIF_SRC_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PLE_HIF_PG_INFO_HIF_RSV_CNT_MASK GENMASK(11, 0)
++
++#define MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MAX_QUOTA_MASK GENMASK(27, 16)
++#define MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MIN_QUOTA_MASK GENMASK(11, 0)
++
++#define MT_DBG_PLE_HIF_TXCMD_PG_INFO_HIF_TXCMD_SRC_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PLE_HIF_TXCMD_PG_INFO_HIF_TXCMD_RSV_CNT_MASK GENMASK(11, 0)
++
++#define MT_DBG_PLE_TXCMD_PG_INFO_HIF_TXCMD_SRC_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PLE_TXCMD_PG_INFO_HIF_TXCMD_RSV_CNT_MASK GENMASK(11, 0)
++
++#define MT_DBG_PLE_PG_CPU_GROUP_CPU_MAX_QUOTA_MASK GENMASK(27, 16)
++#define MT_DBG_PLE_PG_CPU_GROUP_CPU_MIN_QUOTA_MASK GENMASK(11, 0)
++
++#define MT_DBG_PLE_CPU_PG_INFO_CPU_SRC_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PLE_CPU_PG_INFO_CPU_RSV_CNT_MASK GENMASK(11, 0)
++
++#define MT_DBG_PLE_Q_EMPTY_ALL_AC_EMPTY_MASK BIT(24)
++#define MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK BIT(31)
++#define MT_DBG_PLE_FL_QUE_CTRL0_Q_BUF_QID_MASK GENMASK(30, 24)
++
++#define MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT 24
++#define MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT 10
++
++#define MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK GENMASK(27, 16)
++#define MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK GENMASK(11, 0)
++#define MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK GENMASK(11, 0)
++
++#define MT_DBG_PLE_STATION_PAUSE(n) MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_STATION_PAUSE) + ((n) << 2))
++#define MT_DBG_PLE_DIS_STA_MAP(n) MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_DIS_STA_MAP) + ((n) << 2))
++#define MT_DBG_PLE_AC_QEMPTY(ac, n) MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_AC_QEMPTY) + \
++ __DBG_REG_OFFS(dev, DBG_PLE_AC_OFFSET) * (ac) + ((n) << 2))
++
++#define MT_DBG_PLE_AMSDU_PACK_MSDU_CNT(n) MT_DBG_PLE(0x10e0 + ((n) << 2))
++
++/* pseinfo related CRs. */
++#define MT_DBG_PSE_BASE 0x820C8000
++#define MT_DBG_PSE(ofs) (MT_DBG_PSE_BASE + (ofs))
++
++#define MT_DBG_PSE_PBUF_CTRL MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PBUF_CTRL))
++#define MT_DBG_PSE_QUEUE_EMPTY MT_DBG_PSE(0x0b0)
++#define MT_DBG_PSE_FREEPG_CNT MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_FREEPG_CNT))
++#define MT_DBG_PSE_FREEPG_HEAD_TAIL MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_FREEPG_HEAD_TAIL))
++#define MT_DBG_PSE_PG_HIF0_GROUP MT_DBG_PSE(0x110)
++#define MT_DBG_PSE_HIF0_PG_INFO MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_HIF0_PG_INFO))
++#define MT_DBG_PSE_PG_HIF1_GROUP MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_HIF1_GROUP))
++#define MT_DBG_PSE_HIF1_PG_INFO MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_HIF1_PG_INFO))
++#define MT_DBG_PSE_PG_CPU_GROUP MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_CPU_GROUP))
++#define MT_DBG_PSE_CPU_PG_INFO MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_CPU_PG_INFO))
++#define MT_DBG_PSE_PG_LMAC0_GROUP MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_LMAC0_GROUP))
++#define MT_DBG_PSE_LMAC0_PG_INFO MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_LMAC0_PG_INFO))
++#define MT_DBG_PSE_PG_LMAC1_GROUP MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_LMAC1_GROUP))
++#define MT_DBG_PSE_LMAC1_PG_INFO MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_LMAC1_PG_INFO))
++#define MT_DBG_PSE_PG_LMAC2_GROUP MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_LMAC2_GROUP))
++#define MT_DBG_PSE_LMAC2_PG_INFO MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_LMAC2_PG_INFO))
++#define MT_DBG_PSE_PG_PLE_GROUP MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_PLE_GROUP))
++#define MT_DBG_PSE_PLE_PG_INFO MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PLE_PG_INFO))
++#define MT_DBG_PSE_PG_LMAC3_GROUP MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_LMAC3_GROUP))
++#define MT_DBG_PSE_LMAC3_PG_INFO MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_LMAC3_PG_INFO))
++#define MT_DBG_PSE_PG_MDP_GROUP MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_MDP_GROUP))
++#define MT_DBG_PSE_MDP_PG_INFO MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_MDP_PG_INFO))
++#define MT_DBG_PSE_PG_PLE1_GROUP MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_PLE1_GROUP))
++#define MT_DBG_PSE_PLE1_PG_INFO MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PLE1_PG_INFO))
++
++#define MT_DBG_PSE_PBUF_CTRL_PAGE_SIZE_CFG_MASK BIT(31)
++#define MT_DBG_PSE_PBUF_CTRL_PBUF_OFFSET_MASK GENMASK(25, 17)
++#define MT_DBG_PSE_PBUF_CTRL_TOTAL_PAGE_NUM_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_QUEUE_EMPTY_RLS_Q_EMTPY_MASK BIT(31)
++#define MT_DBG_PSE_QUEUE_EMPTY_MDP_RXIOC_QUEUE_EMPTY_MASK BIT(23)
++#define MT_DBG_PSE_QUEUE_EMPTY_MDP_TXIOC_QUEUE_EMPTY_MASK BIT(22)
++#define MT_DBG_PSE_QUEUE_EMPTY_SFD_PARK_QUEUE_EMPTY_MASK BIT(21)
++#define MT_DBG_PSE_QUEUE_EMPTY_SEC_RX_QUEUE_EMPTY_SHFT BIT(20)
++#define MT_DBG_PSE_QUEUE_EMPTY_SEC_TX_QUEUE_EMPTY_MASK BIT(19)
++#define MT_DBG_PSE_QUEUE_EMPTY_MDP_RX_QUEUE_EMPTY_MASK BIT(18)
++#define MT_DBG_PSE_QUEUE_EMPTY_MDP_TX_QUEUE_EMPTY_MASK BIT(17)
++#define MT_DBG_PSE_QUEUE_EMPTY_LMAC_TX_QUEUE_EMPTY_MASK BIT(16)
++#define MT_DBG_PSE_QUEUE_EMPTY_HIF_5_EMPTY_MASK BIT(13)
++#define MT_DBG_PSE_QUEUE_EMPTY_HIF_4_EMPTY_MASK BIT(12)
++#define MT_DBG_PSE_QUEUE_EMPTY_HIF_3_EMPTY_MASK BIT(11)
++#define MT_DBG_PSE_QUEUE_EMPTY_HIF_2_EMPTY_MASK BIT(10)
++#define MT_DBG_PSE_QUEUE_EMPTY_HIF_1_EMPTY_MASK BIT(9)
++#define MT_DBG_PSE_QUEUE_EMPTY_HIF_0_EMPTY_MASK BIT(8)
++#define MT_DBG_PSE_QUEUE_EMPTY_CPU_Q3_EMPTY_MASK BIT(3)
++#define MT_DBG_PSE_QUEUE_EMPTY_CPU_Q2_EMPTY_MASK BIT(2)
++#define MT_DBG_PSE_QUEUE_EMPTY_CPU_Q1_EMPTY_MASK BIT(1)
++#define MT_DBG_PSE_QUEUE_EMPTY_CPU_Q0_EMPTY_MASK BIT(0)
++#define MT_DBG_PSE_FREEPG_CNT_FFA_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_FREEPG_CNT_FREEPG_CNT_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_FREEPG_HEAD_TAIL_FREEPG_TAIL_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_FREEPG_HEAD_TAIL_FREEPG_HEAD_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MAX_QUOTA_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MIN_QUOTA_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MAX_QUOTA_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MIN_QUOTA_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_HIF0_PG_INFO_HIF0_SRC_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_HIF0_PG_INFO_HIF0_RSV_CNT_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_PG_HIF1_GROUP_HIF1_MAX_QUOTA_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_PG_HIF1_GROUP_HIF1_MIN_QUOTA_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_HIF1_PG_INFO_HIF1_SRC_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_HIF1_PG_INFO_HIF1_RSV_CNT_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_CPU_PG_INFO_CPU_SRC_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_CPU_PG_INFO_CPU_RSV_CNT_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_PG_PLE_GROUP_PLE_MAX_QUOTA_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_PG_PLE_GROUP_PLE_MIN_QUOTA_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_PG_CPU_GROUP_CPU_MAX_QUOTA_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_PG_CPU_GROUP_CPU_MIN_QUOTA_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_PLE_PG_INFO_PLE_SRC_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_PLE_PG_INFO_PLE_RSV_CNT_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_PG_LMAC0_GROUP_LMAC0_MAX_QUOTA_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_PG_LMAC0_GROUP_LMAC0_MIN_QUOTA_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_LMAC0_PG_INFO_LMAC0_SRC_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_LMAC0_PG_INFO_LMAC0_RSV_CNT_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_PG_LMAC1_GROUP_LMAC1_MAX_QUOTA_MASK GENMASK(27, 16)
++#define MT_DBG_TOP_PG_LMAC1_GROUP_LMAC1_MIN_QUOTA_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_LMAC1_PG_INFO_LMAC1_SRC_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_LMAC1_PG_INFO_LMAC1_RSV_CNT_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_PG_LMAC2_GROUP_LMAC2_MAX_QUOTA_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_PG_LMAC2_GROUP_LMAC2_MIN_QUOTA_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_LMAC2_PG_INFO_LMAC2_SRC_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_LMAC2_PG_INFO_LMAC2_RSV_CNT_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_PG_LMAC3_GROUP_LMAC3_MAX_QUOTA_MASK GENMASK(27, 16)
++#define MT_DBG_TOP_PG_LMAC3_GROUP_LMAC3_MIN_QUOTA_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_LMAC3_PG_INFO_LMAC3_SRC_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_LMAC3_PG_INFO_LMAC3_RSV_CNT_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_PG_LMAC3_GROUP_LMAC3_MAX_QUOTA_MASK GENMASK(27, 16)
++#define MT_DBG_TOP_PG_LMAC3_GROUP_LMAC3_MIN_QUOTA_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_PG_MDP_GROUP_MDP_MAX_QUOTA_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_PG_MDP_GROUP_MDP_MIN_QUOTA_MASK GENMASK(11, 0)
++#define MT_DBG_PSE_MDP_PG_INFO_MDP_SRC_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_MDP_PG_INFO_MDP_RSV_CNT_MASK GENMASK(11, 0)
++
++#define MT_DBG_PSE_FL_QUE_CTRL_0_ADDR MT_DBG_PLE(0x1b0)
++#define MT_DBG_PSE_FL_QUE_CTRL_0_EXECUTE_MASK BIT(31)
++#define MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_QID_SHFT 24
++#define MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_PID_SHFT 10
++#define MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_WLANID_MASK GENMASK(9, 0)
++
++#define MT_DBG_PSE_FL_QUE_CTRL_2_ADDR MT_DBG_PLE(0x1b8)
++#define MT_DBG_PSE_FL_QUE_CTRL_2_QUEUE_TAIL_FID_MASK GENMASK(27, 16)
++#define MT_DBG_PSE_FL_QUE_CTRL_2_QUEUE_HEAD_FID_MASK GENMASK(11, 0)
++
++#define MT_DBG_PSE_FL_QUE_CTRL_3_ADDR MT_DBG_PLE(0x1bc)
++#define MT_DBG_PSE_FL_QUE_CTRL_3_QUEUE_PKT_NUM_MASK GENMASK(11, 0)
++
++
++/* AGG */
++#define MT_DBG_AGG_BASE(_band) ((_band) ? 0x820f2000 : 0x820e2000)
++#define MT_DBG_AGG(_band, ofs) (MT_DBG_AGG_BASE(_band) + (ofs))
++
++#define MT_DBG_AGG_AALCR0(_band) MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR0))
++#define MT_DBG_AGG_AALCR1(_band) MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR1))
++#define MT_DBG_AGG_AALCR2(_band) MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR2))
++#define MT_DBG_AGG_AALCR3(_band) MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR3))
++#define MT_DBG_AGG_AALCR4(_band) MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR4))
++#define MT_DBG_AGG_B0BRR0(_band) MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_B0BRR0))
++#define MT_DBG_AGG_B1BRR0(_band) MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_B1BRR0))
++#define MT_DBG_AGG_B2BRR0(_band) MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_B2BRR0))
++#define MT_DBG_AGG_B3BRR0(_band) MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_B3BRR0))
++#define MT_DBG_AGG_AWSCR(_band, n) MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AWSCR0) + ((n) << 2))
++#define MT_DBG_AGG_PCR(_band, n) MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_PCR0) + ((n) << 2))
++#define MT_DBG_AGG_TTCR(_band, n) MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_TTCR0) + ((n) << 2))
++#define MT_DBG_MIB_M0ARNG(_band, n) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0ARNG0) + ((n) << 2))
++#define MT_DBG_MIB_M0DR2(_band, n) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR2) + ((n) << 2))
++#define MT_DBG_MIB_M0DR13(_band, n) MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR13) + ((n) << 2))
++
++#define MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK GENMASK(31, 24)
++#define MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK GENMASK(23, 16)
++#define MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK GENMASK(15, 8)
++#define MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK GENMASK(7, 0)
++#define MT_DBG_AGG_AALCR4_ALTX0_AGG_LIMIT_MASK GENMASK(7, 0)
++
++#define MT_DBG_AGG_AWSCR0_WINSIZE3_MASK GENMASK(31, 24)
++#define MT_DBG_AGG_AWSCR0_WINSIZE2_MASK GENMASK(23, 16)
++#define MT_DBG_AGG_AWSCR0_WINSIZE1_MASK GENMASK(15, 8)
++#define MT_DBG_AGG_AWSCR0_WINSIZE0_MASK GENMASK(7, 0)
++
++#define MT_DBG_AGG_AWSCR1_WINSIZE7_MASK GENMASK(31, 24)
++#define MT_DBG_AGG_AWSCR1_WINSIZE6_MASK GENMASK(23, 16)
++#define MT_DBG_AGG_AWSCR1_WINSIZE5_MASK GENMASK(15, 8)
++#define MT_DBG_AGG_AWSCR1_WINSIZE4_MASK GENMASK(7, 0)
++
++#define MT_DBG_AGG_AWSCR2_WINSIZEB_MASK GENMASK(31, 24)
++#define MT_DBG_AGG_AWSCR2_WINSIZEA_MASK GENMASK(23, 16)
++#define MT_DBG_AGG_AWSCR2_WINSIZE9_MASK GENMASK(15, 8)
++#define MT_DBG_AGG_AWSCR2_WINSIZE8_MASK GENMASK(7, 0)
++
++#define MT_DBG_AGG_AWSCR3_WINSIZEE_MASK GENMASK(23, 16)
++#define MT_DBG_AGG_AWSCR3_WINSIZED_MASK GENMASK(15, 8)
++#define MT_DBG_AGG_AWSCR3_WINSIZEC_MASK GENMASK(7, 0)
++
++#define MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL3_MASK GENMASK(31, 24)
++#define MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL2_MASK GENMASK(23, 16)
++#define MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL1_MASK GENMASK(15, 8)
++#define MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL0_MASK GENMASK(7, 0)
++
++#define MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL7_MASK GENMASK(31, 24)
++#define MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL6_MASK GENMASK(23, 16)
++#define MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL5_MASK GENMASK(15, 8)
++#define MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL4_MASK GENMASK(7, 0)
++
++#define MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL11_MASK GENMASK(31, 24)
++#define MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL10_MASK GENMASK(23, 16)
++#define MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL9_MASK GENMASK(15, 8)
++#define MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL8_MASK GENMASK(7, 0)
++
++#define MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL14_MASK GENMASK(23, 16)
++#define MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL13_MASK GENMASK(15, 8)
++#define MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL12_MASK GENMASK(7, 0)
++
++#define MT_DBG_MIB_M0DR2_TRX_AGG_RANGE1_CNT_MASK GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR2_TRX_AGG_RANGE0_CNT_MASK GENMASK(15, 0)
++#define MT_DBG_MIB_M0DR3_TRX_AGG_RANGE3_CNT_MASK GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR3_TRX_AGG_RANGE2_CNT_MASK GENMASK(15, 0)
++#define MT_DBG_MIB_M0DR4_TRX_AGG_RANGE5_CNT_MASK GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR4_TRX_AGG_RANGE4_CNT_MASK GENMASK(15, 0)
++#define MT_DBG_MIB_M0DR5_TRX_AGG_RANGE7_CNT_MASK GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR5_TRX_AGG_RANGE6_CNT_MASK GENMASK(15, 0)
++#define MT_DBG_MIB_M0DR13_TRX_AGG_RANGE9_CNT_MASK GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR13_TRX_AGG_RANGE8_CNT_MASK GENMASK(15, 0)
++#define MT_DBG_MIB_M0DR14_TRX_AGG_RANGE11_CNT_MASK GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR14_TRX_AGG_RANGE10_CNT_MASK GENMASK(15, 0)
++#define MT_DBG_MIB_M0DR15_TRX_AGG_RANGE13_CNT_MASK GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR15_TRX_AGG_RANGE12_CNT_MASK GENMASK(15, 0)
++#define MT_DBG_MIB_M0DR16_TRX_AGG_RANGE15_CNT_MASK GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR16_TRX_AGG_RANGE14_CNT_MASK GENMASK(15, 0)
++
++/* mt7915 host DMA*/
++#define MT_DBG_INT_DMA1_R0_DONE BIT(0)
++#define MT_DBG_INT_DMA1_R1_DONE BIT(1)
++#define MT_DBG_INT_DMA1_R2_DONE BIT(2)
++
++#define MT_DBG_INT_DMA1_T16_DONE BIT(26)
++#define MT_DBG_INT_DMA1_T17_DONE BIT(27)
++#define MT_DBG_INT_DMA1_T18_DONE BIT(30)
++#define MT_DBG_INT_DMA1_T19_DONE BIT(31)
++#define MT_DBG_INT_DMA1_T20_DONE BIT(15)
++
++#define MT_DBG_EXT_WRAP_INT_DMA0_R0_DONE BIT(16)
++#define MT_DBG_EXT_WRAP_INT_DMA0_R1_DONE BIT(17)
++
++/* mt7986 host DMA */
++#define MT_DBG_INT_DMA0_R0_DONE BIT(0)
++#define MT_DBG_INT_DMA0_R1_DONE BIT(1)
++#define MT_DBG_INT_DMA0_R2_DONE BIT(2)
++#define MT_DBG_INT_DMA0_R3_DONE BIT(3)
++#define MT_DBG_INT_DMA0_R4_DONE BIT(22)
++#define MT_DBG_INT_DMA0_R5_DONE BIT(23)
++
++#define MT_DBG_INT_DMA0_T16_DONE BIT(26)
++#define MT_DBG_INT_DMA0_T17_DONE BIT(27)
++#define MT_DBG_INT_DMA0_T18_DONE BIT(30)
++#define MT_DBG_INT_DMA0_T19_DONE BIT(31)
++#define MT_DBG_INT_DMA0_T20_DONE BIT(25)
++
++/* MCU DMA */
++#define WF_WFDMA_MCU_DMA0_BASE 0x54000000
++#define WF_WFDMA_MCU_DMA0_HOST_INT_STA_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x200) // 0200
++#define WF_WFDMA_MCU_DMA0_HOST_INT_ENA_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0X204) // 0204
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x208) // 0208
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK 0x00000008 // RX_DMA_BUSY[3]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT 3
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK 0x00000004 // RX_DMA_EN[2]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT 2
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK 0x00000002 // TX_DMA_BUSY[1]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT 1
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK 0x00000001 // TX_DMA_EN[0]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT 0
++
++#define WF_WFDMA_MCU_DMA1_BASE 0x55000000
++#define WF_WFDMA_MCU_DMA1_HOST_INT_STA_ADDR (WF_WFDMA_MCU_DMA1_BASE + 0x200) // 0200
++#define WF_WFDMA_MCU_DMA1_HOST_INT_ENA_ADDR (WF_WFDMA_MCU_DMA1_BASE + 0X204) // 0204
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_ADDR (WF_WFDMA_MCU_DMA1_BASE + 0x208) // 0208
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK 0x00000008 // RX_DMA_BUSY[3]
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT 3
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_EN_MASK 0x00000004 // RX_DMA_EN[2]
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT 2
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK 0x00000002 // TX_DMA_BUSY[1]
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT 1
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_EN_MASK 0x00000001 // TX_DMA_EN[0]
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT 0
++#define WF_WFDMA_MCU_DMA1_WPDMA_TX_RING0_CTRL0_ADDR (WF_WFDMA_MCU_DMA1_BASE + 0x300) // 0300
++#define WF_WFDMA_MCU_DMA1_WPDMA_TX_RING1_CTRL0_ADDR (WF_WFDMA_MCU_DMA1_BASE + 0x310) // 0310
++#define WF_WFDMA_MCU_DMA1_WPDMA_TX_RING2_CTRL0_ADDR (WF_WFDMA_MCU_DMA1_BASE + 0x320) // 0320
++#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING0_CTRL0_ADDR (WF_WFDMA_MCU_DMA1_BASE + 0x500) // 0500
++#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING1_CTRL0_ADDR (WF_WFDMA_MCU_DMA1_BASE + 0x510) // 0510
++#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING2_CTRL0_ADDR (WF_WFDMA_MCU_DMA1_BASE + 0x520) // 0520
++#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING3_CTRL0_ADDR (WF_WFDMA_MCU_DMA1_BASE + 0x530) // 0530
++#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING4_CTRL0_ADDR (WF_WFDMA_MCU_DMA1_BASE + 0x540) // 0540
++
++#define WF_WFDMA_MCU_DMA1_PCIE1_BASE 0x59000000
++#define WF_WFDMA_MCU_DMA1_PCIE1_HOST_INT_STA_ADDR (WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0x200) // 0200
++#define WF_WFDMA_MCU_DMA1_PCIE1_HOST_INT_ENA_ADDR (WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0X204) // 0204
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_ADDR (WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0x208) // 0208
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK 0x00000008 // RX_DMA_BUSY[3]
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT 3
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_MASK 0x00000004 // RX_DMA_EN[2]
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT 2
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK 0x00000002 // TX_DMA_BUSY[1]
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT 1
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_MASK 0x00000001 // TX_DMA_EN[0]
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT 0
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_TX_RING2_CTRL0_ADDR (WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0x320) // 0320
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_RX_RING3_CTRL0_ADDR (WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0x530) // 0530
++
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x300) // 0300
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x310) // 0310
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x320) // 0320
++/* mt7986 add */
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x330) // 0330
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x340) // 0340
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x350) // 0350
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x360) // 0360
++
++
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x500) // 0500
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x510) // 0510
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x520) // 0520
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x530) // 0530
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x540) // 0540
++
++/* mt7986 add */
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x550) // 0550
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x560) // 0560
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x570) // 0570
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x580) // 0580
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL0_ADDR (WF_WFDMA_MCU_DMA0_BASE + 0x590) // 0590
++
++/* MEM DMA */
++#define WF_WFDMA_MEM_DMA_BASE 0x58000000
++#define WF_WFDMA_MEM_DMA_HOST_INT_STA_ADDR (WF_WFDMA_MEM_DMA_BASE + 0x200) // 0200
++#define WF_WFDMA_MEM_DMA_HOST_INT_ENA_ADDR (WF_WFDMA_MEM_DMA_BASE + 0X204) // 0204
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR (WF_WFDMA_MEM_DMA_BASE + 0x208) // 0208
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK 0x00000008 // RX_DMA_BUSY[3]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT 3
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_MASK 0x00000004 // RX_DMA_EN[2]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_SHFT 2
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK 0x00000002 // TX_DMA_BUSY[1]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT 1
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_MASK 0x00000001 // TX_DMA_EN[0]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_SHFT 0
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL0_ADDR (WF_WFDMA_MEM_DMA_BASE + 0x300) // 0300
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL0_ADDR (WF_WFDMA_MEM_DMA_BASE + 0x310) // 0310
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL0_ADDR (WF_WFDMA_MEM_DMA_BASE + 0x500) // 0500
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL0_ADDR (WF_WFDMA_MEM_DMA_BASE + 0x510) // 0510
++
++enum resource_attr {
++ HIF_TX_DATA,
++ HIF_TX_CMD,
++ HIF_TX_CMD_WM, /* direct path to WMCPU, only exist for WFDMA arch with 2 CPU */
++ HIF_TX_FWDL,
++ HIF_RX_DATA,
++ HIF_RX_EVENT,
++ RING_ATTR_NUM
++};
++
++struct hif_pci_tx_ring_desc {
++ u32 hw_int_mask;
++ u16 ring_size;
++ enum resource_attr ring_attr;
++ u8 band_idx;
++ char *const ring_info;
++};
++
++struct hif_pci_rx_ring_desc {
++ u32 hw_desc_base;
++ u32 hw_int_mask;
++ u16 ring_size;
++ enum resource_attr ring_attr;
++ u16 max_rx_process_cnt;
++ u16 max_sw_read_idx_inc;
++ char *const ring_info;
++};
++
++const struct hif_pci_tx_ring_desc mt7915_tx_ring_layout[] = {
++ {
++ .hw_int_mask = MT_DBG_INT_DMA1_T16_DONE,
++ .ring_size = 128,
++ .ring_attr = HIF_TX_FWDL,
++ .ring_info = "FWDL"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA1_T17_DONE,
++ .ring_size = 256,
++ .ring_attr = HIF_TX_CMD_WM,
++ .ring_info = "cmd to WM"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA1_T18_DONE,
++ .ring_size = 2048,
++ .ring_attr = HIF_TX_DATA,
++ .ring_info = "band0 TXD"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA1_T19_DONE,
++ .ring_size = 2048,
++ .ring_attr = HIF_TX_DATA,
++ .ring_info = "band1 TXD"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA1_T20_DONE,
++ .ring_size = 256,
++ .ring_attr = HIF_TX_CMD,
++ .ring_info = "cmd to WA"
++ }
++};
++
++const struct hif_pci_rx_ring_desc mt7915_rx_ring_layout[] = {
++ {
++ .hw_int_mask = MT_DBG_EXT_WRAP_INT_DMA0_R0_DONE,
++ .ring_size = 1536,
++ .ring_attr = HIF_RX_DATA,
++ .ring_info = "band0 RX data"
++ },
++ {
++ .hw_int_mask = MT_DBG_EXT_WRAP_INT_DMA0_R1_DONE,
++ .ring_size = 1536,
++ .ring_attr = HIF_RX_DATA,
++ .ring_info = "band1 RX data"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA1_R0_DONE,
++ .ring_size = 512,
++ .ring_attr = HIF_RX_EVENT,
++ .ring_info = "event from WM"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA1_R1_DONE,
++ .ring_size = 1024,
++ .ring_attr = HIF_RX_EVENT,
++ .ring_info = "event from WA band0"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA1_R2_DONE,
++ .ring_size = 512,
++ .ring_attr = HIF_RX_EVENT,
++ .ring_info = "event from WA band1"
++ }
++};
++
++const struct hif_pci_tx_ring_desc mt7986_tx_ring_layout[] = {
++ {
++ .hw_int_mask = MT_DBG_INT_DMA0_T16_DONE,
++ .ring_size = 128,
++ .ring_attr = HIF_TX_FWDL,
++ .ring_info = "FWDL"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA0_T17_DONE,
++ .ring_size = 256,
++ .ring_attr = HIF_TX_CMD_WM,
++ .ring_info = "cmd to WM"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA0_T18_DONE,
++ .ring_size = 2048,
++ .ring_attr = HIF_TX_DATA,
++ .ring_info = "band0 TXD"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA0_T19_DONE,
++ .ring_size = 2048,
++ .ring_attr = HIF_TX_DATA,
++ .ring_info = "band1 TXD"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA0_T20_DONE,
++ .ring_size = 256,
++ .ring_attr = HIF_TX_CMD,
++ .ring_info = "cmd to WA"
++ }
++};
++
++const struct hif_pci_rx_ring_desc mt7986_rx_ring_layout[] = {
++ {
++ .hw_int_mask = MT_DBG_INT_DMA0_R4_DONE,
++ .ring_size = 1536,
++ .ring_attr = HIF_RX_DATA,
++ .ring_info = "band0 RX data"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA0_R5_DONE,
++ .ring_size = 1536,
++ .ring_attr = HIF_RX_DATA,
++ .ring_info = "band1 RX data"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA0_R0_DONE,
++ .ring_size = 512,
++ .ring_attr = HIF_RX_EVENT,
++ .ring_info = "event from WM"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA0_R1_DONE,
++ .ring_size = 512,
++ .ring_attr = HIF_RX_EVENT,
++ .ring_info = "event from WA"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA0_R2_DONE,
++ .ring_size = 1024,
++ .ring_attr = HIF_RX_EVENT,
++ .ring_info = "STS WA band0"
++ },
++ {
++ .hw_int_mask = MT_DBG_INT_DMA0_R3_DONE,
++ .ring_size = 512,
++ .ring_attr = HIF_RX_EVENT,
++ .ring_info = "STS WA band1"
++ },
++};
++
++/* mibinfo related CRs. */
++#define BN0_WF_MIB_TOP_BASE 0x820ed000
++#define BN1_WF_MIB_TOP_BASE 0x820fd000
++
++#define BN0_WF_MIB_TOP_BTOCR_ADDR (BN0_WF_MIB_TOP_BASE + 0x400) // D400
++#define BN0_WF_MIB_TOP_BTBCR_ADDR (BN0_WF_MIB_TOP_BASE + 0x428) // D428
++#define BN0_WF_MIB_TOP_BTDCR_ADDR (BN0_WF_MIB_TOP_BASE + 0x4F0) // D4F0
++
++#define BN0_WF_MIB_TOP_BSDR0_ADDR (BN0_WF_MIB_TOP_BASE + 0x688) // D688
++#define BN0_WF_MIB_TOP_BSDR1_ADDR (BN0_WF_MIB_TOP_BASE + 0x690) // D690
++
++#define BN0_WF_MIB_TOP_BSDR2_ADDR (BN0_WF_MIB_TOP_BASE + 0x518) // D518
++#define BN0_WF_MIB_TOP_BSDR3_ADDR (BN0_WF_MIB_TOP_BASE + 0x520) // D520
++#define BN0_WF_MIB_TOP_BSDR4_ADDR (BN0_WF_MIB_TOP_BASE + 0x528) // D528
++#define BN0_WF_MIB_TOP_BSDR5_ADDR (BN0_WF_MIB_TOP_BASE + 0x530) // D530
++#define BN0_WF_MIB_TOP_BSDR6_ADDR (BN0_WF_MIB_TOP_BASE + 0x538) // D538
++
++#define BN0_WF_MIB_TOP_BROCR_ADDR (BN0_WF_MIB_TOP_BASE + 0x5B8) // D5B8
++#define BN0_WF_MIB_TOP_BRBCR_ADDR (BN0_WF_MIB_TOP_BASE + 0x5E0) // D5E0
++#define BN0_WF_MIB_TOP_BRDCR_ADDR (BN0_WF_MIB_TOP_BASE + 0x630) // D630
++
++#define BN0_WF_MIB_TOP_M0SDR0_BEACONTXCOUNT_MASK 0x0000FFFF // BEACONTXCOUNT[15..0]
++
++#define BN0_WF_MIB_TOP_M0SDR4_RX_FIFO_FULL_COUNT_MASK 0x0000FFFF // RX_FIFO_FULL_COUNT[15..0]
++
++#define BN0_WF_MIB_TOP_M0SDR5_RX_MPDU_COUNT_MASK 0xFFFFFFFF // RX_MPDU_COUNT[31..0]
++
++#define BN0_WF_MIB_TOP_M0SDR6_CHANNEL_IDLE_COUNT_MASK 0x0000FFFF // CHANNEL_IDLE_COUNT[15..0]
++
++#define BN1_WF_MIB_TOP_BTOCR_ADDR (BN1_WF_MIB_TOP_BASE + 0x400) // D400
++
++#define BN0_WF_MIB_TOP_M0SDR7_VEC_MISS_COUNT_MASK 0x0000FFFF // VEC_MISS_COUNT[15..0]
++#define BN0_WF_MIB_TOP_M0SDR8_DELIMITER_FAIL_COUNT_MASK 0x0000FFFF // DELIMITER_FAIL_COUNT[15..0]
++#define BN0_WF_MIB_TOP_M0SDR9_CCA_NAV_TX_TIME_MASK 0x00FFFFFF // CCA_NAV_TX_TIME[23..0]
++
++#define BN0_WF_MIB_TOP_M0SDR11_RX_LEN_MISMATCH_MASK 0x0000FFFF // RX_LEN_MISMATCH[15..0]
++
++#define BN0_WF_MIB_TOP_M0SDR16_P_CCA_TIME_MASK 0x00FFFFFF // P_CCA_TIME[23..0]
++#define BN0_WF_MIB_TOP_M0SDR17_S_CCA_TIME_MASK 0x00FFFFFF // S_CCA_TIME[23..0]
++#define BN0_WF_MIB_TOP_M0SDR18_P_ED_TIME_MASK 0x00FFFFFF // P_ED_TIME[23..0]
++#define BN0_WF_MIB_TOP_M0SDR19_CCK_MDRDY_TIME_MASK 0x00FFFFFF // CCK_MDRDY_TIME[23..0]
++#define BN0_WF_MIB_TOP_M0SDR20_OFDM_LG_MIXED_VHT_MDRDY_TIME_MASK 0x00FFFFFF // OFDM_LG_MIXED_VHT_MDRDY_TIME[23..0]
++#define BN0_WF_MIB_TOP_M0SDR21_OFDM_GREEN_MDRDY_TIME_MASK 0x00FFFFFF // OFDM_GREEN_MDRDY_TIME[23..0]
++
++#define BN0_WF_MIB_TOP_M0SDR22_ADDR (BN0_WF_MIB_TOP_BASE + 0x60) // D060
++#define BN0_WF_MIB_TOP_M0SDR23_ADDR (BN0_WF_MIB_TOP_BASE + 0x64) // D064
++
++#define BN0_WF_MIB_TOP_M0SDR34_MUBF_TX_COUNT_MASK 0x0000FFFF // MUBF_TX_COUNT[15..0]
++
++#define BN0_WF_MIB_TOP_M0DR0_TX_40MHZ_CNT_MASK 0xFFFF0000 // TX_40MHZ_CNT[31..16]
++#define BN0_WF_MIB_TOP_M0DR0_TX_40MHZ_CNT_SHFT 16
++#define BN0_WF_MIB_TOP_M0DR0_TX_20MHZ_CNT_MASK 0x0000FFFF // TX_20MHZ_CNT[15..0]
++#define BN0_WF_MIB_TOP_M0DR0_TX_20MHZ_CNT_SHFT 0
++
++#define BN0_WF_MIB_TOP_M0DR1_TX_160MHZ_CNT_MASK 0xFFFF0000 // TX_160MHZ_CNT[31..16]
++#define BN0_WF_MIB_TOP_M0DR1_TX_160MHZ_CNT_SHFT 16
++#define BN0_WF_MIB_TOP_M0DR1_TX_80MHZ_CNT_MASK 0x0000FFFF // TX_80MHZ_CNT[15..0]
++#define BN0_WF_MIB_TOP_M0DR1_TX_80MHZ_CNT_SHFT 0
++
++#define BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG2_CNT_MASK 0xFFFF0000 // TX_DDLMT_RNG2_CNT[31..16]
++#define BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG2_CNT_SHFT 16
++#define BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG1_CNT_MASK 0x0000FFFF // TX_DDLMT_RNG1_CNT[15..0]
++#define BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG1_CNT_SHFT 0
++
++#define BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG4_CNT_MASK 0xFFFF0000 // TX_DDLMT_RNG4_CNT[31..16]
++#define BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG4_CNT_SHFT 16
++#define BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG3_CNT_MASK 0x0000FFFF // TX_DDLMT_RNG3_CNT[15..0]
++#define BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG3_CNT_SHFT 0
++
++#define BN0_WF_MIB_TOP_M0DR10_MU_FAIL_PPDU_CNT_MASK 0x0000FFFF // MU_FAIL_PPDU_CNT[15..0]
++
++#define BN0_WF_MIB_TOP_M0B0SDR0_ADDR (BN0_WF_MIB_TOP_BASE + 0x100) // D100
++#define BN0_WF_MIB_TOP_M0B0SDR0_RTSRETRYCOUNT_MASK 0xFFFF0000 // RTSRETRYCOUNT[31..16]
++#define BN0_WF_MIB_TOP_M0B0SDR0_RTSRETRYCOUNT_SHFT 16
++#define BN0_WF_MIB_TOP_M0B0SDR0_RTSTXCOUNT_MASK 0x0000FFFF // RTSTXCOUNT[15..0]
++#define BN0_WF_MIB_TOP_M0B0SDR0_RTSTXCOUNT_SHFT 0
++#define BN0_WF_MIB_TOP_M0B0SDR1_ADDR (BN0_WF_MIB_TOP_BASE + 0x104) // D104
++#define BN0_WF_MIB_TOP_M0B0SDR1_ACKFAILCOUNT_MASK 0xFFFF0000 // ACKFAILCOUNT[31..16]
++#define BN0_WF_MIB_TOP_M0B0SDR1_ACKFAILCOUNT_SHFT 16
++#define BN0_WF_MIB_TOP_M0B0SDR1_BAMISSCOUNT_MASK 0x0000FFFF // BAMISSCOUNT[15..0]
++#define BN0_WF_MIB_TOP_M0B0SDR1_BAMISSCOUNT_SHFT 0
++#define BN0_WF_MIB_TOP_M0B0SDR2_ADDR (BN0_WF_MIB_TOP_BASE + 0x108) // D108
++#define BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRY2COUNT_MASK 0xFFFF0000 // FRAMERETRY2COUNT[31..16]
++#define BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRY2COUNT_SHFT 16
++#define BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRYCOUNT_MASK 0x0000FFFF // FRAMERETRYCOUNT[15..0]
++#define BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRYCOUNT_SHFT 0
++#define BN0_WF_MIB_TOP_M0B0SDR3_ADDR (BN0_WF_MIB_TOP_BASE + 0x10C) // D10C
++#define BN0_WF_MIB_TOP_M0B0SDR3_FRAMERETRY3COUNT_MASK 0x0000FFFF // FRAMERETRY3COUNT[15..0]
++#define BN0_WF_MIB_TOP_M0B0SDR3_FRAMERETRY3COUNT_SHFT 0
++#define BN0_WF_MIB_TOP_M0DR12_TX_DDLMT_RNG0_CNT_MASK 0x0000FFFF // TX_DDLMT_RNG0_CNT[15..0]
++
++
++#define BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_MASK 0xFFFF0000 // TX_OK_COUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_SHFT 16
++#define BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_MASK 0x0000FFFF // TX_OK_COUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_SHFT 0
++
++#define BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2np1_MASK 0xFFFF0000 // TX_DATA_COUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2np1_SHFT 16
++#define BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2n_MASK 0x0000FFFF // TX_DATA_COUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2n_SHFT 0
++
++#define BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_MASK 0xFFFF0000 // RX_OK_COUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_SHFT 16
++#define BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_MASK 0x0000FFFF // RX_OK_COUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_SHFT 0
++
++#define BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2np1_MASK 0xFFFF0000 // RX_DATA_COUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2np1_SHFT 16
++#define BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2n_MASK 0x0000FFFF // RX_DATA_COUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2n_SHFT 0
++
++#define BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2np1_MASK 0xFFFF0000 // RTSTXCOUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2np1_SHFT 16
++#define BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2n_MASK 0x0000FFFF // RTSTXCOUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2n_SHFT 0
++
++#define BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2np1_MASK 0xFFFF0000 // RTSRETRYCOUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2np1_SHFT 16
++#define BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2n_MASK 0x0000FFFF // RTSRETRYCOUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2n_SHFT 0
++
++#define BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2np1_MASK 0xFFFF0000 // BAMISSCOUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2np1_SHFT 16
++#define BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2n_MASK 0x0000FFFF // BAMISSCOUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2n_SHFT 0
++
++#define BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2np1_MASK 0xFFFF0000 // ACKFAILCOUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2np1_SHFT 16
++#define BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2n_MASK 0x0000FFFF // ACKFAILCOUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2n_SHFT 0
++
++#define BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2np1_MASK 0xFFFF0000 // FRAMERETRYCOUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2np1_SHFT 16
++#define BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2n_MASK 0x0000FFFF // FRAMERETRYCOUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2n_SHFT 0
++
++#define BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2np1_MASK 0xFFFF0000 // FRAMERETRY2COUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2np1_SHFT 16
++#define BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2n_MASK 0x0000FFFF // FRAMERETRY2COUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2n_SHFT 0
++
++#define BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2np1_MASK 0xFFFF0000 // FRAMERETRY3COUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2np1_SHFT 16
++#define BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2n_MASK 0x0000FFFF // FRAMERETRY3COUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2n_SHFT 0
++/* TXD */
++
++#define MT_TXD1_ETYP BIT(15)
++#define MT_TXD1_VLAN BIT(14)
++#define MT_TXD1_RMVL BIT(13)
++#define MT_TXD1_AMS BIT(13)
++#define MT_TXD1_EOSP BIT(12)
++#define MT_TXD1_MRD BIT(11)
++
++#define MT_TXD7_CTXD BIT(26)
++#define MT_TXD7_CTXD_CNT GENMASK(25, 23)
++#define MT_TXD7_TAT GENMASK(9, 0)
++
++#endif
++#endif
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+new file mode 100644
+index 00000000..747a9014
+--- /dev/null
++++ b/mt7915/mtk_debugfs.c
+@@ -0,0 +1,2925 @@
++#include<linux/inet.h>
++#include "mt7915.h"
++#include "mt7915_debug.h"
++#include "mac.h"
++#include "mcu.h"
++
++#ifdef MTK_DEBUG
++#define LWTBL_IDX2BASE_ID GENMASK(14, 8)
++#define LWTBL_IDX2BASE_DW GENMASK(7, 2)
++#define LWTBL_IDX2BASE(_id, _dw) (MT_DBG_WTBL_BASE | \
++ FIELD_PREP(LWTBL_IDX2BASE_ID, _id) | \
++ FIELD_PREP(LWTBL_IDX2BASE_DW, _dw))
++
++#define UWTBL_IDX2BASE_ID GENMASK(12, 6)
++#define UWTBL_IDX2BASE_DW GENMASK(5, 2)
++#define UWTBL_IDX2BASE(_id, _dw) (MT_DBG_UWTBL_TOP_BASE | 0x2000 | \
++ FIELD_PREP(UWTBL_IDX2BASE_ID, _id) | \
++ FIELD_PREP(UWTBL_IDX2BASE_DW, _dw))
++
++#define KEYTBL_IDX2BASE_KEY GENMASK(12, 6)
++#define KEYTBL_IDX2BASE_DW GENMASK(5, 2)
++#define KEYTBL_IDX2BASE(_key, _dw) (MT_DBG_UWTBL_TOP_BASE | 0x2000 | \
++ FIELD_PREP(KEYTBL_IDX2BASE_KEY, _key) | \
++ FIELD_PREP(KEYTBL_IDX2BASE_DW, _dw))
++
++enum mt7915_wtbl_type {
++ WTBL_TYPE_LMAC, /* WTBL in LMAC */
++ WTBL_TYPE_UMAC, /* WTBL in UMAC */
++ WTBL_TYPE_KEY, /* Key Table */
++ MAX_NUM_WTBL_TYPE
++};
++
++static int mt7915_wtbl_read_raw(struct mt7915_dev *dev, u16 idx,
++ enum mt7915_wtbl_type type, u16 start_dw,
++ u16 len, void *buf)
++{
++ u32 *dest_cpy = (u32 *)buf;
++ u32 size_dw = len;
++ u32 src = 0;
++
++ if (!buf)
++ return 0xFF;
++
++ if (type == WTBL_TYPE_LMAC) {
++ mt76_wr(dev, MT_DBG_WTBLON_TOP_WDUCR,
++ FIELD_PREP(MT_DBG_WTBLON_TOP_WDUCR_GROUP, (idx >> 7)));
++ src = LWTBL_IDX2BASE(idx, start_dw);
++ } else if (type == WTBL_TYPE_UMAC) {
++ mt76_wr(dev, MT_DBG_UWTBL_TOP_WDUCR,
++ FIELD_PREP(MT_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++ src = UWTBL_IDX2BASE(idx, start_dw);
++ } else if (type == WTBL_TYPE_KEY) {
++ mt76_wr(dev, MT_DBG_UWTBL_TOP_WDUCR,
++ MT_UWTBL_TOP_WDUCR_TARGET |
++ FIELD_PREP(MT_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++ src = KEYTBL_IDX2BASE(idx, start_dw);
++ }
++
++ while (size_dw--) {
++ *dest_cpy++ = mt76_rr(dev, src);
++ src += 4;
++ };
++
++ return 0;
++}
++
++static int mt7915_wtbl_write_raw(struct mt7915_dev *dev, u16 idx,
++ enum mt7915_wtbl_type type, u16 start_dw,
++ u32 val)
++{
++ u32 addr = 0;
++
++ if (type == WTBL_TYPE_LMAC) {
++ mt76_wr(dev, MT_DBG_WTBLON_TOP_WDUCR,
++ FIELD_PREP(MT_WTBLON_TOP_WDUCR_GROUP, (idx >> 7)));
++ addr = LWTBL_IDX2BASE(idx, start_dw);
++ } else if (type == WTBL_TYPE_UMAC) {
++ mt76_wr(dev, MT_DBG_UWTBL_TOP_WDUCR,
++ FIELD_PREP(MT_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++ addr = UWTBL_IDX2BASE(idx, start_dw);
++ } else if (type == WTBL_TYPE_KEY) {
++ mt76_wr(dev, MT_DBG_UWTBL_TOP_WDUCR,
++ MT_UWTBL_TOP_WDUCR_TARGET |
++ FIELD_PREP(MT_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++ addr = KEYTBL_IDX2BASE(idx, start_dw);
++ }
++
++ mt76_wr(dev, addr, val);
++
++ return 0;
++}
++
++void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len)
++{
++ struct bin_debug_hdr *hdr;
++ char *buf;
++
++ if (len > 1500 - sizeof(*hdr))
++ len = 1500 - sizeof(*hdr);
++
++ buf = kzalloc(sizeof(*hdr) + len, GFP_KERNEL);
++ if (!buf)
++ return;
++
++ hdr = (struct bin_debug_hdr *)buf;
++ hdr->magic_num = cpu_to_le32(PKT_BIN_DEBUG_MAGIC);
++ hdr->serial_id = cpu_to_le16(dev->dbg.fwlog_seq++);
++ hdr->msg_type = cpu_to_le16(type);
++ hdr->len = cpu_to_le16(len);
++ hdr->des_len = cpu_to_le16(des_len);
++
++ memcpy(buf + sizeof(*hdr), data, len);
++
++ mt7915_debugfs_rx_log(dev, buf, sizeof(*hdr) + len);
++}
++
++static int
++mt7915_fw_debug_module_set(void *data, u64 module)
++{
++ struct mt7915_dev *dev = data;
++
++ dev->dbg.fw_dbg_module = module;
++ return 0;
++}
++
++static int
++mt7915_fw_debug_module_get(void *data, u64 *module)
++{
++ struct mt7915_dev *dev = data;
++
++ *module = dev->dbg.fw_dbg_module;
++ return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_module, mt7915_fw_debug_module_get,
++ mt7915_fw_debug_module_set, "%lld\n");
++
++static int
++mt7915_fw_debug_level_set(void *data, u64 level)
++{
++ struct mt7915_dev *dev = data;
++
++ dev->dbg.fw_dbg_lv = level;
++ mt7915_mcu_fw_dbg_ctrl(dev, dev->dbg.fw_dbg_module, dev->dbg.fw_dbg_lv);
++ return 0;
++}
++
++static int
++mt7915_fw_debug_level_get(void *data, u64 *level)
++{
++ struct mt7915_dev *dev = data;
++
++ *level = dev->dbg.fw_dbg_lv;
++ return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_level, mt7915_fw_debug_level_get,
++ mt7915_fw_debug_level_set, "%lld\n");
++
++#define MAX_TX_MODE 12
++static char *HW_TX_MODE_STR[] = {"CCK", "OFDM", "HT-Mix", "HT-GF", "VHT",
++ "N/A", "N/A", "N/A", "HE_SU", "HE_EXT_SU",
++ "HE_TRIG", "HE_MU", "N/A"};
++static char *HW_TX_RATE_CCK_STR[] = {"1M", "2Mlong", "5.5Mlong", "11Mlong",
++ "N/A", "2Mshort", "5.5Mshort", "11Mshort",
++ "N/A"};
++static char *HW_TX_RATE_OFDM_STR[] = {"6M", "9M", "12M", "18M", "24M", "36M",
++ "48M", "54M", "N/A"};
++static char *fcap_str[] = {"20MHz", "20/40MHz", "20/40/80MHz",
++ "20/40/80/160/80+80MHz"};
++
++static char *hw_rate_ofdm_str(u16 ofdm_idx)
++{
++ switch (ofdm_idx) {
++ case 11: /* 6M */
++ return HW_TX_RATE_OFDM_STR[0];
++
++ case 15: /* 9M */
++ return HW_TX_RATE_OFDM_STR[1];
++
++ case 10: /* 12M */
++ return HW_TX_RATE_OFDM_STR[2];
++
++ case 14: /* 18M */
++ return HW_TX_RATE_OFDM_STR[3];
++
++ case 9: /* 24M */
++ return HW_TX_RATE_OFDM_STR[4];
++
++ case 13: /* 36M */
++ return HW_TX_RATE_OFDM_STR[5];
++
++ case 8: /* 48M */
++ return HW_TX_RATE_OFDM_STR[6];
++
++ case 12: /* 54M */
++ return HW_TX_RATE_OFDM_STR[7];
++
++ default:
++ return HW_TX_RATE_OFDM_STR[8];
++ }
++}
++
++static char *hw_rate_str(u8 mode, u16 rate_idx)
++{
++ if (mode == 0)
++ return rate_idx < 8 ? HW_TX_RATE_CCK_STR[rate_idx] : HW_TX_RATE_CCK_STR[8];
++ else if (mode == 1)
++ return hw_rate_ofdm_str(rate_idx);
++ else
++ return "MCS";
++}
++
++static void parse_rate(struct seq_file *s, u16 rate_idx, u16 txrate)
++{
++ u16 txmode, mcs, nss, stbc;
++
++ txmode = FIELD_GET(GENMASK(9, 6), txrate);
++ mcs = FIELD_GET(GENMASK(5, 0), txrate);
++ nss = FIELD_GET(GENMASK(12, 10), txrate);
++ stbc = FIELD_GET(BIT(13), txrate);
++
++ seq_printf(s, "\tRate%d(0x%x):TxMode=%d(%s), TxRate=%d(%s), Nsts=%d, STBC=%d\n",
++ rate_idx + 1, txrate,
++ txmode, (txmode < MAX_TX_MODE ? HW_TX_MODE_STR[txmode] : HW_TX_MODE_STR[MAX_TX_MODE]),
++ mcs, hw_rate_str(txmode, mcs), nss, stbc);
++}
++
++#define LWTBL_LEN_IN_DW 32
++#define UWTBL_LEN_IN_DW 8
++#define ONE_KEY_ENTRY_LEN_IN_DW 8
++static int mt7915_sta_info(struct seq_file *s, void *data)
++{
++ struct mt7915_dev *dev = dev_get_drvdata(s->private);
++ u8 lwtbl[LWTBL_LEN_IN_DW*4] = {0};
++ u16 i = 0;
++
++ for (i=0; i < mt7915_wtbl_size(dev); i++) {
++ mt7915_wtbl_read_raw(dev, i, WTBL_TYPE_LMAC, 0,
++ LWTBL_LEN_IN_DW, lwtbl);
++ if (lwtbl[4] || lwtbl[5] || lwtbl[6] || lwtbl[7] || lwtbl[0] || lwtbl[1])
++ seq_printf(s, "wcid:%d\tAddr: %02x:%02x:%02x:%02x:%02x:%02x\n",
++ i, lwtbl[4], lwtbl[5], lwtbl[6], lwtbl[7], lwtbl[0], lwtbl[1]);
++ }
++
++ return 0;
++}
++
++static int mt7915_wtbl_read(struct seq_file *s, void *data)
++{
++ struct mt7915_dev *dev = dev_get_drvdata(s->private);
++ u8 lwtbl[LWTBL_LEN_IN_DW*4] = {0};
++ int x;
++ u32 *addr = 0;
++ u32 dw_value = 0;
++
++ mt7915_wtbl_read_raw(dev, dev->wlan_idx, WTBL_TYPE_LMAC, 0,
++ LWTBL_LEN_IN_DW, lwtbl);
++ seq_printf(s, "Dump WTBL info of WLAN_IDX:%d\n", dev->wlan_idx);
++ seq_printf(s, "LMAC WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++ MT_DBG_WTBLON_TOP_WDUCR,
++ mt76_rr(dev, MT_DBG_WTBLON_TOP_WDUCR),
++ LWTBL_IDX2BASE(dev->wlan_idx, 0));
++ for (x = 0; x < LWTBL_LEN_IN_DW; x++) {
++ seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
++ x,
++ lwtbl[x * 4 + 3],
++ lwtbl[x * 4 + 2],
++ lwtbl[x * 4 + 1],
++ lwtbl[x * 4]);
++ }
++
++ seq_printf(s, "\n\tAddr: %02x:%02x:%02x:%02x:%02x:%02x(D0[B0~15], D1[B0~31])\n",
++ lwtbl[4], lwtbl[5], lwtbl[6], lwtbl[7], lwtbl[0], lwtbl[1]);
++
++ // DW0, DW1
++ seq_printf(s, "LWTBL DW 0/1\n\t");
++ addr = (u32 *)&(lwtbl[0]);
++ dw_value = *addr;
++ seq_printf(s, "MUAR_IDX:%lu/ ", FIELD_GET(GENMASK(21, 16), dw_value));
++ seq_printf(s, "RCA1:%ld/ ", FIELD_GET(BIT(22), dw_value));
++ seq_printf(s, "KID:%lu/ ", FIELD_GET(GENMASK(24, 23), dw_value));
++ seq_printf(s, "RCID:%ld/ ", FIELD_GET(BIT(25), dw_value));
++ seq_printf(s, "FROM_DS:%ld\n\t", FIELD_GET(BIT(26), dw_value));
++ seq_printf(s, "TO_DS:%ld/ ", FIELD_GET(BIT(27), dw_value));
++ seq_printf(s, "RV:%ld/ ", FIELD_GET(BIT(28), dw_value));
++ seq_printf(s, "RCA2:%ld/ ", FIELD_GET(BIT(29), dw_value));
++ seq_printf(s, "WPI_FLAG:%ld\n", FIELD_GET(BIT(30), dw_value));
++
++ // DW2
++ seq_printf(s, "LWTBL DW 2\n\t");
++ addr = (u32 *)&(lwtbl[2*4]);
++ dw_value = *addr;
++ seq_printf(s, "AID12:%lu/ ", FIELD_GET(GENMASK(11, 0), dw_value));
++ seq_printf(s, "SU:%ld/ ", FIELD_GET(BIT(12), dw_value));
++ seq_printf(s, "SPP_EN:%ld/ ", FIELD_GET(BIT(13), dw_value));
++ seq_printf(s, "WPI_EVEN:%ld\n\t",FIELD_GET(BIT(14), dw_value));
++ seq_printf(s, "CIPHER:%lu/ ", FIELD_GET(GENMASK(20, 16), dw_value));
++ seq_printf(s, "CIPHER_IGTK:%lu/ ",FIELD_GET(GENMASK(22, 21), dw_value));
++ seq_printf(s, "AAD_OM:%ld\n\t", FIELD_GET(BIT(15), dw_value));
++ seq_printf(s, "SW:%ld/ ", FIELD_GET(BIT(24), dw_value));
++ seq_printf(s, "UL:%ld/ ", FIELD_GET(BIT(25), dw_value));
++ seq_printf(s, "TX_POWER_SAVE:%ld\n\t", FIELD_GET(BIT(26), dw_value));
++ seq_printf(s, "QOS:%ld/ ", FIELD_GET(BIT(27), dw_value));
++ seq_printf(s, "HT:%ld/ ", FIELD_GET(BIT(28), dw_value));
++ seq_printf(s, "VHT:%ld/ ", FIELD_GET(BIT(29), dw_value));
++ seq_printf(s, "HE:%ld/ ", FIELD_GET(BIT(30), dw_value));
++ seq_printf(s, "MESH:%ld\n", FIELD_GET(BIT(31), dw_value));
++
++ // DW3
++ seq_printf(s, "LWTBL DW 3\n\t");
++ addr = (u32 *)&(lwtbl[3*4]);
++ dw_value = *addr;
++ seq_printf(s, "WMM_Q:%lu/ ", FIELD_GET(GENMASK(1, 0), dw_value));
++ seq_printf(s, "RXD_DUP_MODE:%lu\n\t", FIELD_GET(GENMASK(3, 2), dw_value));
++ seq_printf(s, "VLAN2ETH:%ld/ ", FIELD_GET(BIT(4), dw_value));
++ seq_printf(s, "BEAM_CHG:%ld/ ", FIELD_GET(BIT(5), dw_value));
++ seq_printf(s, "DIS_BA256:%ld\n\t", FIELD_GET(BIT(6), dw_value));
++ seq_printf(s, "PFMU_IDX:%lu/ ", FIELD_GET(GENMASK(15, 8), dw_value));
++ seq_printf(s, "ULPF_IDX:%lu\n\t", FIELD_GET(GENMASK(23, 16), dw_value));
++ seq_printf(s, "RIBF:%ld/ ", FIELD_GET(BIT(24), dw_value));
++ seq_printf(s, "ULPF:%ld\n\t", FIELD_GET(BIT(25), dw_value));
++ seq_printf(s, "IGN_FBK:%ld/ ", FIELD_GET(BIT(26), dw_value));
++ seq_printf(s, "TBF:%ld/ ", FIELD_GET(BIT(29), dw_value));
++ seq_printf(s, "TBF_VHT:%ld/ ", FIELD_GET(BIT(30), dw_value));
++ seq_printf(s, "TBF_HE:%ld\n", FIELD_GET(BIT(31), dw_value));
++
++ // DW4
++ seq_printf(s, "LWTBL DW 4\n\t");
++ addr = (u32 *)&(lwtbl[4*4]);
++ dw_value = *addr;
++ seq_printf(s, "ANT_ID_STS0:%lu/ ", FIELD_GET(GENMASK(2, 0), dw_value));
++ seq_printf(s, "STS1:%lu/ ", FIELD_GET(GENMASK(5, 3), dw_value));
++ seq_printf(s, "STS2:%lu/ ", FIELD_GET(GENMASK(8, 6), dw_value));
++ seq_printf(s, "STS3:%lu\n\t", FIELD_GET(GENMASK(11, 9), dw_value));
++ seq_printf(s, "ANT_ID_STS4:%lu/ ", FIELD_GET(GENMASK(14, 12), dw_value));
++ seq_printf(s, "STS5:%lu/ ", FIELD_GET(GENMASK(17, 15), dw_value));
++ seq_printf(s, "STS6:%ld/ ", FIELD_GET(GENMASK(20, 18), dw_value));
++ seq_printf(s, "STS7:%lu\n\t", FIELD_GET(GENMASK(23, 21), dw_value));
++ seq_printf(s, "CASCAD:%ld/ ", FIELD_GET(BIT(24), dw_value));
++ seq_printf(s, "LDPC_HT:%ld/ ", FIELD_GET(BIT(25), dw_value));
++ seq_printf(s, "LDPC_VHT:%ld/ ", FIELD_GET(BIT(26), dw_value));
++ seq_printf(s, "LDPC_HE:%ld\n\t", FIELD_GET(BIT(27), dw_value));
++ seq_printf(s, "DIS_RHTR:%ld/ ", FIELD_GET(BIT(28), dw_value));
++ seq_printf(s, "ALL_ACK:%ld/ ", FIELD_GET(BIT(29), dw_value));
++ seq_printf(s, "DROP:%ld/ ", FIELD_GET(BIT(30), dw_value));
++ seq_printf(s, "ACK_EN:%ld\n", FIELD_GET(BIT(31), dw_value));
++
++ // DW5
++ seq_printf(s, "LWTBL DW 5\n\t");
++ addr = (u32 *)&(lwtbl[5*4]);
++ dw_value = *addr;
++ seq_printf(s, "AF:%lu/ ", FIELD_GET(GENMASK(2, 0), dw_value));
++ seq_printf(s, "AF_HE:%lu/ ", FIELD_GET(GENMASK(4, 3), dw_value));
++ seq_printf(s, "RTS:%ld/ ", FIELD_GET(BIT(5), dw_value));
++ seq_printf(s, "SMPS:%ld/ ", FIELD_GET(BIT(6), dw_value));
++ seq_printf(s, "DYN_BW:%ld\n\t", FIELD_GET(BIT(7), dw_value));
++ seq_printf(s, "MMSS:%lu/ ", FIELD_GET(GENMASK(10, 8), dw_value));
++ seq_printf(s, "USR:%ld/ ", FIELD_GET(BIT(11), dw_value));
++ seq_printf(s, "SR_RATE:%lu/ ", FIELD_GET(GENMASK(14, 12), dw_value));
++ seq_printf(s, "SR_ABORT:%ld\n\t", FIELD_GET(BIT(15), dw_value));
++ seq_printf(s, "TX_POWER_OFFSET:%lu/ ", FIELD_GET(GENMASK(21, 16), dw_value));
++ seq_printf(s, "WTBL_MPDU_SIZE:%lu\n\t", FIELD_GET(GENMASK(23, 22), dw_value));
++ seq_printf(s, "PE:%lu/ ", FIELD_GET(GENMASK(25, 24), dw_value));
++ seq_printf(s, "DOPPL:%ld/ ", FIELD_GET(BIT(26), dw_value));
++ seq_printf(s, "TXOP_PS_CAP:%ld/ ", FIELD_GET(BIT(27), dw_value));
++ seq_printf(s, "DONOT_UPDATE_I_PSM:%ld\n\t", FIELD_GET(BIT(28), dw_value));
++ seq_printf(s, "I_PSM:%ld/ ", FIELD_GET(BIT(29), dw_value));
++ seq_printf(s, "PSM:%ld/ ", FIELD_GET(BIT(30), dw_value));
++ seq_printf(s, "SKIP_TX:%ld\n", FIELD_GET(BIT(31), dw_value));
++
++ // DW6
++ seq_printf(s, "LWTBL DW 6\n\t");
++ seq_printf(s, "TID 0/1/2/3/4/5/6/7 BA_WIN_SIZE:");
++ addr = (u32 *)&(lwtbl[6*4]);
++ dw_value = *addr;
++ seq_printf(s, "%lu/ ", FIELD_GET(GENMASK(3, 0), dw_value));
++ seq_printf(s, "%lu/ ", FIELD_GET(GENMASK(7, 4), dw_value));
++ seq_printf(s, "%lu/ ", FIELD_GET(GENMASK(11, 8), dw_value));
++ seq_printf(s, "%lu/ ", FIELD_GET(GENMASK(15, 12), dw_value));
++ seq_printf(s, "%lu/ ", FIELD_GET(GENMASK(19, 16), dw_value));
++ seq_printf(s, "%lu/ ", FIELD_GET(GENMASK(23, 20), dw_value));
++ seq_printf(s, "%lu/ ", FIELD_GET(GENMASK(27, 24), dw_value));
++ seq_printf(s, "%lu\n", FIELD_GET(GENMASK(31, 28), dw_value));
++
++ // DW7
++ seq_printf(s, "LWTBL DW 7\n\t");
++ addr = (u32 *)&(lwtbl[7*4]);
++ dw_value = *addr;
++ seq_printf(s, "CBRN:%lu/ ", FIELD_GET(GENMASK(2, 0), dw_value));
++ seq_printf(s, "DBNSS_EN:%ld/ ", FIELD_GET(BIT(3), dw_value));
++ seq_printf(s, "BAF_EN:%ld/ ", FIELD_GET(BIT(4), dw_value));
++ seq_printf(s, "RDGBA:%ld\n\t", FIELD_GET(BIT(5), dw_value));
++ seq_printf(s, "RDG:%ld/ ", FIELD_GET(BIT(6), dw_value));
++ seq_printf(s, "SPE_IDX:%lu/ ", FIELD_GET(GENMASK(11, 7), dw_value));
++ seq_printf(s, "G2:%ld/ ", FIELD_GET(BIT(12), dw_value));
++ seq_printf(s, "G4:%ld/ ", FIELD_GET(BIT(13), dw_value));
++ seq_printf(s, "G8:%ld/ ", FIELD_GET(BIT(14), dw_value));
++ seq_printf(s, "G16:%ld\n\t", FIELD_GET(BIT(15), dw_value));
++ seq_printf(s, "G2_LTF:%lu/ ", FIELD_GET(GENMASK(17, 16), dw_value));
++ seq_printf(s, "G4_LTF:%lu/ ", FIELD_GET(GENMASK(19, 18), dw_value));
++ seq_printf(s, "G8_LTF:%lu/ ", FIELD_GET(GENMASK(21, 20), dw_value));
++ seq_printf(s, "G16_LTF:%lu\n\t", FIELD_GET(GENMASK(23, 22), dw_value));
++ seq_printf(s, "G2_HE:%lu/ ", FIELD_GET(GENMASK(25, 24), dw_value));
++ seq_printf(s, "G4_HE:%lu/ ", FIELD_GET(GENMASK(27, 27), dw_value));
++ seq_printf(s, "G8_HE:%lu/ ", FIELD_GET(GENMASK(29, 28), dw_value));
++ seq_printf(s, "G16_HE:%lu\n", FIELD_GET(GENMASK(31, 30), dw_value));
++
++ // DW8
++ seq_printf(s, "LWTBL DW 8\n\t");
++ addr = (u32 *)&(lwtbl[8*4]);
++ dw_value = *addr;
++ seq_printf(s, "FAIL_CNT_AC0:%lu/ ", FIELD_GET(GENMASK(4, 0), dw_value));
++ seq_printf(s, "AC1:%lu/ ", FIELD_GET(GENMASK(9, 5), dw_value));
++ seq_printf(s, "AC2:%lu/ ", FIELD_GET(GENMASK(14, 10), dw_value));
++ seq_printf(s, "AC3:%lu\n\t", FIELD_GET(GENMASK(19, 15), dw_value));
++ seq_printf(s, "PARTIAL_AID:%lu/ ", FIELD_GET(GENMASK(28, 20), dw_value));
++ seq_printf(s, "CHK_PER:%lu\n", FIELD_GET(BIT(31), dw_value));
++
++ // DW9
++ seq_printf(s, "LWTBL DW 9\n\t");
++ addr = (u32 *)&(lwtbl[9*4]);
++ dw_value = *addr;
++ seq_printf(s, "RX_AVG_MPDU:%lu/ ", FIELD_GET(GENMASK(13, 0), dw_value));
++ seq_printf(s, "PRITX_SW_MODE:%ld/ ", FIELD_GET(BIT(16), dw_value));
++ seq_printf(s, "PRITX_PLR:%ld\n\t", FIELD_GET(BIT(17), dw_value));
++ seq_printf(s, "PRITX_DCM:%ld/ ", FIELD_GET(BIT(18), dw_value));
++ seq_printf(s, "PRITX_ER160:%ld/ ", FIELD_GET(BIT(19), dw_value));
++ seq_printf(s, "PRITX_ERSU:%lu\n\t", FIELD_GET(BIT(20), dw_value));
++ seq_printf(s, "MPDU_FAIL_CNT:%lu/ ", FIELD_GET(GENMASK(25, 23), dw_value));
++ seq_printf(s, "MPDU_OK_CNT:%lu/ ", FIELD_GET(GENMASK(28, 26), dw_value));
++ seq_printf(s, "RATE_IDX:%lu\n\t", FIELD_GET(GENMASK(31, 29), dw_value));
++ seq_printf(s, "FCAP:%s\n", fcap_str[FIELD_GET(GENMASK(22, 21), dw_value)]);
++
++ // DW10
++ seq_printf(s, "LWTBL DW 10\n");
++ addr = (u32 *)&(lwtbl[10*4]);
++ dw_value = *addr;
++ parse_rate(s, 0, FIELD_GET(GENMASK(13, 0), dw_value));
++ parse_rate(s, 1, FIELD_GET(GENMASK(29, 16), dw_value));
++ // DW11
++ seq_printf(s, "LWTBL DW 11\n");
++ addr = (u32 *)&(lwtbl[11*4]);
++ dw_value = *addr;
++ parse_rate(s, 2, FIELD_GET(GENMASK(13, 0), dw_value));
++ parse_rate(s, 3, FIELD_GET(GENMASK(29, 16), dw_value));
++ // DW12
++ seq_printf(s, "LWTBL DW 12\n");
++ addr = (u32 *)&(lwtbl[12*4]);
++ dw_value = *addr;
++ parse_rate(s, 4, FIELD_GET(GENMASK(13, 0), dw_value));
++ parse_rate(s, 5, FIELD_GET(GENMASK(29, 16), dw_value));
++ // DW13
++ seq_printf(s, "LWTBL DW 13\n");
++ addr = (u32 *)&(lwtbl[13*4]);
++ dw_value = *addr;
++ parse_rate(s, 6, FIELD_GET(GENMASK(13, 0), dw_value));
++ parse_rate(s, 7, FIELD_GET(GENMASK(29, 16), dw_value));
++
++ //DW28
++ seq_printf(s, "LWTBL DW 28\n\t");
++ addr = (u32 *)&(lwtbl[28*4]);
++ dw_value = *addr;
++ seq_printf(s, "OM_INFO:%lu/ ", FIELD_GET(GENMASK(11, 0), dw_value));
++ seq_printf(s, "OM_RXD_DUP_MODE:%u\n\t", !!(dw_value & BIT(12)) );
++
++ //DW29
++ seq_printf(s, "LWTBL DW 29\n");
++ addr = (u32 *)&(lwtbl[29*4]);
++ dw_value = *addr;
++ seq_printf(s, "USER_RSSI:%lu/ ", FIELD_GET(GENMASK(8, 0), dw_value));
++ seq_printf(s, "USER_SNR:%lu/ ", FIELD_GET(GENMASK(14, 9), dw_value));
++ seq_printf(s, "RAPID_REACTION_RATE:%lu/ ", FIELD_GET(GENMASK(26, 16), dw_value));
++ seq_printf(s, "HT_AMSDU(Read Only):%u/ ", !!(dw_value & BIT(30)) );
++ seq_printf(s, "AMSDU_CROSS_LG(Read Only):%u\n\t ", !!(dw_value & BIT(31)));
++
++ //DW30
++ seq_printf(s, "LWTBL DW 30\n\t");
++ addr = (u32 *)&(lwtbl[30*4]);
++ dw_value = *addr;
++ seq_printf(s, "RCPI 0:%lu/ ", FIELD_GET(GENMASK(7, 0), dw_value));
++ seq_printf(s, "RCPI 1:%lu/ ", FIELD_GET(GENMASK(15, 8), dw_value));
++ seq_printf(s, "RCPI 2:%lu/ ", FIELD_GET(GENMASK(23, 16), dw_value));
++ seq_printf(s, "RCPI 3:%lu\n\t", FIELD_GET(GENMASK(31, 24), dw_value));
++
++ //DW31
++ seq_printf(s, "LWTBL DW 31\n\t");
++ addr = (u32 *)&(lwtbl[31*4]);
++ dw_value = *addr;
++ seq_printf(s, "RCPI 4:%lu/ ", FIELD_GET(GENMASK(7, 0), dw_value));
++ seq_printf(s, "RCPI 5:%lu/ ", FIELD_GET(GENMASK(15, 8), dw_value));
++ seq_printf(s, "RCPI 6:%lu/ ", FIELD_GET(GENMASK(23, 16), dw_value));
++ seq_printf(s, "RCPI 7:%lu\n\t", FIELD_GET(GENMASK(31, 24), dw_value));
++
++ return 0;
++}
++
++static int mt7915_uwtbl_read(struct seq_file *s, void *data)
++{
++ struct mt7915_dev *dev = dev_get_drvdata(s->private);
++ u8 uwtbl[UWTBL_LEN_IN_DW * 4] = {0};
++ u8 keytbl[ONE_KEY_ENTRY_LEN_IN_DW*4] = {0};
++ int x;
++ u32 *addr = 0;
++ u32 dw_value = 0;
++ u32 amsdu_len = 0;
++ u32 u2SN = 0;
++ u16 keyloc0, keyloc1;
++
++ mt7915_wtbl_read_raw(dev, dev->wlan_idx, WTBL_TYPE_UMAC, 0,
++ UWTBL_LEN_IN_DW, uwtbl);
++ seq_printf(s, "Dump WTBL info of WLAN_IDX:%d\n", dev->wlan_idx);
++ seq_printf(s, "UMAC WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++ MT_DBG_WTBLON_TOP_WDUCR,
++ mt76_rr(dev, MT_DBG_WTBLON_TOP_WDUCR),
++ UWTBL_IDX2BASE(dev->wlan_idx, 0));
++ for (x = 0; x < UWTBL_LEN_IN_DW; x++) {
++ seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
++ x,
++ uwtbl[x * 4 + 3],
++ uwtbl[x * 4 + 2],
++ uwtbl[x * 4 + 1],
++ uwtbl[x * 4]);
++ }
++
++ /* UMAC WTBL DW 0 */
++ seq_printf(s, "\nUWTBL PN\n\t");
++ addr = (u32 *)&(uwtbl[0]);
++ dw_value = *addr;
++ seq_printf(s, "PN0:%lu/ ", FIELD_GET(GENMASK(7, 0), dw_value));
++ seq_printf(s, "PN1:%lu/ ", FIELD_GET(GENMASK(15, 8), dw_value));
++ seq_printf(s, "PN2:%lu\n\t", FIELD_GET(GENMASK(23, 16), dw_value));
++ seq_printf(s, "PN3:%lu/ ", FIELD_GET(GENMASK(31, 24), dw_value));
++
++ addr = (u32 *)&(uwtbl[1 * 4]);
++ dw_value = *addr;
++ seq_printf(s, "PN4:%lu/ ", FIELD_GET(GENMASK(7, 0), dw_value));
++ seq_printf(s, "PN5:%lu\n", FIELD_GET(GENMASK(15, 8), dw_value));
++
++ /* UMAC WTBL DW SN part */
++ seq_printf(s, "\nUWTBL SN\n");
++ addr = (u32 *)&(uwtbl[2 * 4]);
++ dw_value = *addr;
++ seq_printf(s, "TID0_AC0_SN:%lu\n", FIELD_GET(GENMASK(11, 0), dw_value));
++ seq_printf(s, "TID1_AC1_SN:%lu\n", FIELD_GET(GENMASK(23, 12), dw_value));
++
++ u2SN = FIELD_GET(GENMASK(31, 24), dw_value);
++ addr = (u32 *)&(uwtbl[3 * 4]);
++ dw_value = *addr;
++ u2SN |= FIELD_GET(GENMASK(3, 0), dw_value);
++ seq_printf(s, "TID2_AC2_SN:%u\n", u2SN);
++ seq_printf(s, "TID3_AC3_SN:%lu\n", FIELD_GET(GENMASK(15, 4), dw_value));
++ seq_printf(s, "TID4_SN:%lu\n", FIELD_GET(GENMASK(27, 16), dw_value));
++
++ u2SN = FIELD_GET(GENMASK(31, 28), dw_value);
++ addr = (u32 *)&(uwtbl[4 * 4]);
++ dw_value = *addr;
++ u2SN |= FIELD_GET(GENMASK(7, 0), dw_value);
++ seq_printf(s, "TID5_SN:%u\n", u2SN);
++ seq_printf(s, "TID6_SN:%lu\n", FIELD_GET(GENMASK(19, 8), dw_value));
++ seq_printf(s, "TID7_SN:%lu\n", FIELD_GET(GENMASK(31, 20), dw_value));
++
++ addr = (u32 *)&(uwtbl[1 * 4]);
++ dw_value = *addr;
++ seq_printf(s, "COM_SN:%lu\n", FIELD_GET(GENMASK(27, 16), dw_value));
++
++ /* UMAC WTBL DW 0 */
++ seq_printf(s, "\nUWTBL others\n");
++
++ addr = (u32 *)&(uwtbl[5 * 4]);
++ dw_value = *addr;
++ keyloc0 = FIELD_GET(GENMASK(10, 0), dw_value);
++ keyloc1 = FIELD_GET(GENMASK(26, 16), dw_value);
++ seq_printf(s, "\tKey Loc 1/2:%lu/%lu\n",
++ FIELD_GET(GENMASK(10, 0), dw_value),
++ FIELD_GET(GENMASK(26, 16), dw_value));
++ seq_printf(s, "\tUWTBL_QOS:%lu\n", FIELD_GET(BIT(27), dw_value));
++ seq_printf(s, "\tUWTBL_HT_VHT_HE:%lu\n", FIELD_GET(BIT(28), dw_value));
++
++ addr = (u32 *)&(uwtbl[6*4]);
++ dw_value = *addr;
++ seq_printf(s, "\tHW AMSDU Enable:%lu\n", FIELD_GET(BIT(9), dw_value));
++
++ amsdu_len = FIELD_GET(GENMASK(5, 0), dw_value);
++ if (amsdu_len == 0)
++ seq_printf(s, "\tHW AMSDU Len:invalid (WTBL value=0x%x)\n", amsdu_len);
++ else if (amsdu_len == 1)
++ seq_printf(s, "\tHW AMSDU Len:%d~%d (WTBL value=0x%x)\n",
++ 1,
++ 255,
++ amsdu_len);
++ else
++ seq_printf(s, "\tHW AMSDU Len:%d~%d (WTBL value=0x%x)\n",
++ 256 * (amsdu_len - 1),
++ 256 * (amsdu_len - 1) + 255,
++ amsdu_len
++ );
++ seq_printf(s, "\tHW AMSDU Num:%lu (WTBL value=0x%lx)\n",
++ FIELD_GET(GENMASK(8, 6), dw_value) + 1,
++ FIELD_GET(GENMASK(8, 6), dw_value));
++
++ /* Parse KEY link */
++ seq_printf(s, "\n\tkeyloc0:%d\n", keyloc0);
++ if(keyloc0 != GENMASK(10, 0)) {
++ mt7915_wtbl_read_raw(dev, keyloc0, WTBL_TYPE_KEY,
++ 0, ONE_KEY_ENTRY_LEN_IN_DW, keytbl);
++ seq_printf(s, "KEY WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++ MT_DBG_WTBLON_TOP_WDUCR,
++ mt76_rr(dev, MT_DBG_WTBLON_TOP_WDUCR),
++ KEYTBL_IDX2BASE(keyloc0, 0));
++
++ for (x = 0; x < ONE_KEY_ENTRY_LEN_IN_DW; x++) {
++ seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
++ x,
++ keytbl[x * 4 + 3],
++ keytbl[x * 4 + 2],
++ keytbl[x * 4 + 1],
++ keytbl[x * 4]);
++ }
++ }
++
++ seq_printf(s, "\n\tkeyloc1:%d\n", keyloc1);
++ if(keyloc1 != GENMASK(26, 16)) {
++ mt7915_wtbl_read_raw(dev, keyloc1, WTBL_TYPE_KEY,
++ 0, ONE_KEY_ENTRY_LEN_IN_DW, keytbl);
++ seq_printf(s, "KEY WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++ MT_DBG_WTBLON_TOP_WDUCR,
++ mt76_rr(dev, MT_DBG_WTBLON_TOP_WDUCR),
++ KEYTBL_IDX2BASE(keyloc1, 0));
++
++ for (x = 0; x < ONE_KEY_ENTRY_LEN_IN_DW; x++) {
++ seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
++ x,
++ keytbl[x * 4 + 3],
++ keytbl[x * 4 + 2],
++ keytbl[x * 4 + 1],
++ keytbl[x * 4]);
++ }
++ }
++ return 0;
++}
++
++static void
++dump_dma_tx_ring_info(struct seq_file *s, struct mt7915_dev *dev, char *str, u32 ring_base)
++{
++ u32 base, cnt, cidx, didx, queue_cnt;
++
++ base= mt76_rr(dev, ring_base);
++ cnt = mt76_rr(dev, ring_base + 4);
++ cidx = mt76_rr(dev, ring_base + 8);
++ didx = mt76_rr(dev, ring_base + 12);
++ queue_cnt = (cidx >= didx) ? (cidx - didx) : (cidx - didx + cnt);
++
++ seq_printf(s, "%20s %10x %10x %10x %10x %10x\n", str, base, cnt, cidx, didx, queue_cnt);
++}
++
++static void
++dump_dma_rx_ring_info(struct seq_file *s, struct mt7915_dev *dev, char *str, u32 ring_base)
++{
++ u32 base, cnt, cidx, didx, queue_cnt;
++
++ base= mt76_rr(dev, ring_base);
++ cnt = mt76_rr(dev, ring_base + 4);
++ cidx = mt76_rr(dev, ring_base + 8);
++ didx = mt76_rr(dev, ring_base + 12);
++ queue_cnt = (didx > cidx) ? (didx - cidx - 1) : (didx - cidx + cnt - 1);
++
++ seq_printf(s, "%20s %10x %10x %10x %10x %10x\n", str, base, cnt, cidx, didx, queue_cnt);
++}
++
++static void
++mt7915_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
++{
++ u32 sys_ctrl[10] = {};
++
++ /* HOST DMA */
++ sys_ctrl[0] = mt76_rr(dev, MT_DBG_INT_SOURCE_CSR);
++ sys_ctrl[1] = mt76_rr(dev, MT_DBG_INT_MASK_CSR);
++ sys_ctrl[2] = mt76_rr(dev, MT_DBG_WFDMA0_INT_SOURCE_CSR);
++ sys_ctrl[3] = mt76_rr(dev, MT_DBG_WFDMA0_INT_MASK_CSR);
++ sys_ctrl[4] = mt76_rr(dev, MT_DBG_WFDMA1_INT_SOURCE_CSR);
++ sys_ctrl[5] = mt76_rr(dev, MT_DBG_WFDMA1_INT_MASK_CSR);
++ sys_ctrl[6] = mt76_rr(dev, MT_DBG_WFDMA0_GLO_CFG);
++ sys_ctrl[7] = mt76_rr(dev, MT_DBG_WFDMA1_GLO_CFG);
++ seq_printf(s, "HOST_DMA Configuration\n");
++ seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++ "DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++ seq_printf(s, "%10s %10x %10x\n",
++ "Merge", sys_ctrl[0], sys_ctrl[1]);
++ seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
++ "DMA0", sys_ctrl[2], sys_ctrl[3], sys_ctrl[6],
++ FIELD_GET(MT_DBG_WFDMA0_GLO_CFG_TX_DMA_EN, sys_ctrl[6]),
++ FIELD_GET(MT_DBG_WFDMA0_GLO_CFG_RX_DMA_EN, sys_ctrl[6]),
++ FIELD_GET(MT_DBG_WFDMA0_GLO_CFG_TX_BUSY_MASK, sys_ctrl[6]),
++ FIELD_GET(MT_DBG_WFDMA0_GLO_CFG_RX_BUSY_MASK, sys_ctrl[6]));
++
++ seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
++ "DMA1", sys_ctrl[4], sys_ctrl[5], sys_ctrl[7],
++ FIELD_GET(MT_DBG_WFDMA1_GLO_CFG_TX_DMA_EN, sys_ctrl[7]),
++ FIELD_GET(MT_DBG_WFDMA1_GLO_CFG_RX_DMA_EN, sys_ctrl[7]),
++ FIELD_GET(MT_DBG_WFDMA1_GLO_CFG_TX_BUSY_MASK, sys_ctrl[7]),
++ FIELD_GET(MT_DBG_WFDMA1_GLO_CFG_RX_BUSY_MASK, sys_ctrl[7]));
++
++ sys_ctrl[0] = mt76_rr(dev, MT_DBG_INT1_SOURCE_CSR);
++ sys_ctrl[1] = mt76_rr(dev, MT_DBG_INT1_MASK_CSR);
++ sys_ctrl[2] = mt76_rr(dev, MT_DBG_WFDMA0_PCIE1_INT_SOURCE_CSR);
++ sys_ctrl[3] = mt76_rr(dev, MT_DBG_WFDMA0_PCIE1_INT_MASK_CSR);
++ sys_ctrl[4] = mt76_rr(dev, MT_DBG_WFDMA1_PCIE1_INT_SOURCE_CSR);
++ sys_ctrl[5] = mt76_rr(dev, MT_DBG_WFDMA1_PCIE1_INT_MASK_CSR);
++ sys_ctrl[6] = mt76_rr(dev, MT_DBG_WFDMA0_PCIE1_GLO_CFG);
++ sys_ctrl[7] = mt76_rr(dev, MT_DBG_WFDMA1_PCIE1_GLO_CFG);
++ seq_printf(s, "%10s %10x %10x\n",
++ "MergeP1", sys_ctrl[0], sys_ctrl[1]);
++ seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
++ "DMA0P1", sys_ctrl[2], sys_ctrl[3], sys_ctrl[6],
++ FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_DMA_EN, sys_ctrl[6]),
++ FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_DMA_EN, sys_ctrl[6]),
++ FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_BUSY_MASK, sys_ctrl[6]),
++ FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_BUSY_MASK, sys_ctrl[6]));
++ seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
++ "DMA1P1", sys_ctrl[4], sys_ctrl[5], sys_ctrl[7],
++ FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_DMA_EN, sys_ctrl[7]),
++ FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_DMA_EN, sys_ctrl[7]),
++ FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_BUSY_MASK, sys_ctrl[7]),
++ FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_BUSY_MASK, sys_ctrl[7]));
++
++ seq_printf(s, "HOST_DMA0 Ring Configuration\n");
++ seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++ "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++ dump_dma_rx_ring_info(s, dev, "R0:Data0(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(0));
++ dump_dma_rx_ring_info(s, dev, "R1:Data1(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(1));
++
++ seq_printf(s, "HOST_DMA0 PCIe 1 Ring Configuration\n");
++ seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++ "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++ dump_dma_rx_ring_info(s, dev, "R1:Data1(MAC2H)", MT_DBG_WFDMA0_PCIE1_RX1_CTRL0);
++
++ seq_printf(s, "HOST_DMA1 Ring Configuration\n");
++ seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++ "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++ dump_dma_tx_ring_info(s, dev, "T16:FWDL", MT_DBG_TX_RING_CTRL(0));
++ dump_dma_tx_ring_info(s, dev, "T17:Cmd(H2WM)", MT_DBG_TX_RING_CTRL(1));
++ dump_dma_tx_ring_info(s, dev, "T18:TXD0(H2WA)", MT_DBG_TX_RING_CTRL(2));
++ dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)", MT_DBG_TX_RING_CTRL(3));
++ dump_dma_tx_ring_info(s, dev, "T20:Cmd(H2WA)", MT_DBG_TX_RING_CTRL(4));
++ dump_dma_rx_ring_info(s, dev, "R0:Event(WM2H)", MT_DBG_RX_EVENT_RING_CTRL(0));
++ dump_dma_rx_ring_info(s, dev, "R1:Event0(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(1));
++ dump_dma_rx_ring_info(s, dev, "R2:Event1(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(2));
++
++ seq_printf(s, "HOST_DMA1 PCIe 1 Ring Configuration\n");
++ seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++ "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++ dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)", MT_DBG_WFDMA1_PCIE1_TX19_CTRL0);
++ dump_dma_rx_ring_info(s, dev, "R2:Event1(WA2H)", MT_DBG_WFDMA1_PCIE1_RX2_CTRL0);
++}
++
++static void
++mt7915_show_mcu_dma_info(struct seq_file *s, struct mt7915_dev *dev)
++{
++ u32 sys_ctrl[9] = {};
++
++ /* MCU DMA information */
++ sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR);
++ sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_STA_ADDR);
++ sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_ENA_ADDR);
++
++ sys_ctrl[3] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_ADDR);
++ sys_ctrl[4] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_HOST_INT_STA_ADDR);
++ sys_ctrl[5] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_HOST_INT_ENA_ADDR);
++ sys_ctrl[6] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_ADDR);
++ sys_ctrl[7] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_PCIE1_HOST_INT_STA_ADDR);
++ sys_ctrl[8] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_PCIE1_HOST_INT_ENA_ADDR);
++
++ seq_printf(s, "MCU_DMA Configuration\n");
++ seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++ "DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++ seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++ "DMA0", sys_ctrl[1], sys_ctrl[2], sys_ctrl[0],
++ (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++ (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++ (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++ (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++
++ seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++ "DMA1", sys_ctrl[4], sys_ctrl[5], sys_ctrl[3],
++ (sys_ctrl[3] & WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++ (sys_ctrl[3] & WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++ (sys_ctrl[3] & WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++ (sys_ctrl[3] & WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++ seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++ "DMA1P1", sys_ctrl[7], sys_ctrl[8], sys_ctrl[6],
++ (sys_ctrl[6] & WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++ (sys_ctrl[6] & WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++ (sys_ctrl[6] & WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++ (sys_ctrl[6] & WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++
++ seq_printf(s, "MCU_DMA0 Ring Configuration\n");
++ seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++ "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++ dump_dma_tx_ring_info(s, dev, "T0:TXD(WM2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL0_ADDR);
++ dump_dma_tx_ring_info(s, dev, "T1:TXCMD(WM2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL0_ADDR);
++ dump_dma_tx_ring_info(s, dev, "T2:TXD(WA2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R0:Data(MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R1:TxDone(MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R2:SPL(MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R3:TxDone(MAC2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R4:TXS(MAC2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL0_ADDR);
++
++ seq_printf(s, "MCU_DMA1 Ring Configuration\n");
++ seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++ "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++ dump_dma_tx_ring_info(s, dev, "T0:Event(WM2H)", WF_WFDMA_MCU_DMA1_WPDMA_TX_RING0_CTRL0_ADDR);
++ dump_dma_tx_ring_info(s, dev, "T1:Event0(WA2H)", WF_WFDMA_MCU_DMA1_WPDMA_TX_RING1_CTRL0_ADDR);
++ dump_dma_tx_ring_info(s, dev, "T2:Event1(WA2H)", WF_WFDMA_MCU_DMA1_WPDMA_TX_RING2_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R0:FWDL", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING0_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R1:Cmd(H2WM)", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING1_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R2:TXD0(H2WA)", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING2_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R3:TXD1(H2WA)", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING3_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R4:Cmd(H2WA)", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING4_CTRL0_ADDR);
++
++ seq_printf(s, "MCU_DMA1 PCIe 1 Ring Configuration\n");
++ seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++ "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++ dump_dma_tx_ring_info(s, dev, "T2:Event1(WA2H)", WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_TX_RING2_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R3:TXD1(H2WA)", WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_RX_RING3_CTRL0_ADDR);
++}
++
++static void
++mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
++{
++ u32 sys_ctrl[5] = {};
++
++ /* HOST DMA */
++ sys_ctrl[0] = mt76_rr(dev, MT_DBG_INT_SOURCE_CSR);
++ sys_ctrl[1] = mt76_rr(dev, MT_DBG_INT_MASK_CSR);
++ sys_ctrl[2] = mt76_rr(dev, MT_DBG_WFDMA0_INT_SOURCE_CSR);
++ sys_ctrl[3] = mt76_rr(dev, MT_DBG_WFDMA0_INT_MASK_CSR);
++ sys_ctrl[4] = mt76_rr(dev, MT_DBG_WFDMA0_GLO_CFG);
++
++ seq_printf(s, "HOST_DMA Configuration\n");
++ seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++ "DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++ seq_printf(s, "%10s %10x %10x\n",
++ "Merge", sys_ctrl[0], sys_ctrl[1]);
++ seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
++ "DMA0", sys_ctrl[2], sys_ctrl[3], sys_ctrl[4],
++ FIELD_GET(MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_TX_DMA_EN_MASK, sys_ctrl[4]),
++ FIELD_GET(MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_RX_DMA_EN_MASK, sys_ctrl[4]),
++ FIELD_GET(MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_TX_DMA_BUSY_MASK, sys_ctrl[4]),
++ FIELD_GET(MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_RX_DMA_BUSY_MASK, sys_ctrl[4]));
++
++
++ seq_printf(s, "HOST_DMA0 Ring Configuration\n");
++ seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++ "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++ dump_dma_tx_ring_info(s, dev, "T16:FWDL", MT_DBG_TX_RING_CTRL(0));
++ dump_dma_tx_ring_info(s, dev, "T17:Cmd(H2WM)", MT_DBG_TX_RING_CTRL(1));
++ dump_dma_tx_ring_info(s, dev, "T18:TXD0(H2WA)", MT_DBG_TX_RING_CTRL(2));
++ dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)", MT_DBG_TX_RING_CTRL(3));
++ dump_dma_tx_ring_info(s, dev, "T20:Cmd(H2WA)", MT_DBG_TX_RING_CTRL(4));
++ dump_dma_rx_ring_info(s, dev, "R0:Event(WM2H)", MT_DBG_RX_DATA_RING_CTRL(0));
++ dump_dma_rx_ring_info(s, dev, "R1:Event(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(1));
++ dump_dma_rx_ring_info(s, dev, "R2:TxDone(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(2));
++ dump_dma_rx_ring_info(s, dev, "R3:TxDone1(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(3));
++ dump_dma_rx_ring_info(s, dev, "R4:Data0(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(0));
++ dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(1));
++}
++
++static void
++mt7986_show_mcu_dma_info(struct seq_file *s, struct mt7915_dev *dev)
++{
++ u32 sys_ctrl[3] = {};
++
++ /* MCU DMA information */
++ sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR);
++ sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_STA_ADDR);
++ sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_ENA_ADDR);
++
++ seq_printf(s, "MCU_DMA Configuration\n");
++ seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++ "DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++ seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++ "DMA0", sys_ctrl[1], sys_ctrl[2], sys_ctrl[0],
++ (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++ (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++ (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++ (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++
++ seq_printf(s, "MCU_DMA0 Ring Configuration\n");
++ seq_printf(s, "%22s %10s %10s %10s %10s %10s\n",
++ "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++ dump_dma_tx_ring_info(s, dev, "T0:Event (WM2H)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL0_ADDR);
++ dump_dma_tx_ring_info(s, dev, "T1:Event (WA2H)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL0_ADDR);
++ dump_dma_tx_ring_info(s, dev, "T2:TxDone (WA2H)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL0_ADDR);
++ dump_dma_tx_ring_info(s, dev, "T3:TxDone1 (WA2H)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL0_ADDR);
++ dump_dma_tx_ring_info(s, dev, "T4:TXD (WM2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL0_ADDR);
++ dump_dma_tx_ring_info(s, dev, "T5:TXCMD (WM2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL0_ADDR);
++ dump_dma_tx_ring_info(s, dev, "T6:TXD (WA2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R0:FWDL", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R1:Cmd (H2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R2:TXD (H2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R3:TXD1 (H2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R4:Cmd (H2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R5:Data (MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R6:TxDone/STS (MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R7:RPT (MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R8:TxDone/STS (MAC2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R9:Data1 (MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL0_ADDR);
++
++}
++
++static void
++mt7915_show_dma_info(struct seq_file *s, struct mt7915_dev *dev)
++{
++ u32 sys_ctrl[10] = {};
++
++ if(is_mt7915(&dev->mt76)) {
++ mt7915_show_host_dma_info(s, dev);
++ mt7915_show_mcu_dma_info(s, dev);
++ } else {
++ mt7986_show_host_dma_info(s, dev);
++ mt7986_show_mcu_dma_info(s, dev);
++ }
++
++ /* MEM DMA information */
++ sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR);
++ sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_MEM_DMA_HOST_INT_STA_ADDR);
++ sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_MEM_DMA_HOST_INT_ENA_ADDR);
++
++ seq_printf(s, "MEM_DMA Configuration\n");
++ seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++ "DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++ seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++ "MEM", sys_ctrl[1], sys_ctrl[2], sys_ctrl[0],
++ (sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++ (sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++ (sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++ (sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++
++ seq_printf(s, "MEM_DMA Ring Configuration\n");
++ seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++ "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++ dump_dma_tx_ring_info(s, dev, "T0:CmdEvent(WM2WA)", WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL0_ADDR);
++ dump_dma_tx_ring_info(s, dev, "T1:CmdEvent(WA2WM)", WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R0:CmdEvent(WM2WA)", WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL0_ADDR);
++ dump_dma_rx_ring_info(s, dev, "R1:CmdEvent(WA2WM)", WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL0_ADDR);
++}
++
++static int mt7915_trinfo_read(struct seq_file *s, void *data)
++{
++ struct mt7915_dev *dev = dev_get_drvdata(s->private);
++ const struct hif_pci_tx_ring_desc *tx_ring_layout;
++ const struct hif_pci_rx_ring_desc *rx_ring_layout;
++ u32 tx_ring_num, rx_ring_num;
++ u32 tbase[5], tcnt[5];
++ u32 tcidx[5], tdidx[5];
++ u32 rbase[6], rcnt[6];
++ u32 rcidx[6], rdidx[6];
++ int idx;
++
++ if(is_mt7915(&dev->mt76)) {
++ tx_ring_layout = &mt7915_tx_ring_layout[0];
++ rx_ring_layout = &mt7915_rx_ring_layout[0];
++ tx_ring_num = ARRAY_SIZE(mt7915_tx_ring_layout);
++ rx_ring_num = ARRAY_SIZE(mt7915_rx_ring_layout);
++ } else {
++ tx_ring_layout = &mt7986_tx_ring_layout[0];
++ rx_ring_layout = &mt7986_rx_ring_layout[0];
++ tx_ring_num = ARRAY_SIZE(mt7986_tx_ring_layout);
++ rx_ring_num = ARRAY_SIZE(mt7986_rx_ring_layout);
++ }
++
++ for (idx = 0; idx < tx_ring_num; idx++) {
++ tbase[idx] = mt76_rr(dev, MT_DBG_TX_RING_CTRL(idx));
++ tcnt[idx] = mt76_rr(dev, MT_DBG_TX_RING_CTRL(idx) + 0x04);
++ tcidx[idx] = mt76_rr(dev, MT_DBG_TX_RING_CTRL(idx) + 0x08);
++ tdidx[idx] = mt76_rr(dev, MT_DBG_TX_RING_CTRL(idx) + 0x0c);
++ }
++
++ for (idx = 0; idx < rx_ring_num; idx++) {
++ if (idx < 2) {
++ rbase[idx] = mt76_rr(dev, MT_DBG_RX_DATA_RING_CTRL(idx));
++ rcnt[idx] = mt76_rr(dev, MT_DBG_RX_DATA_RING_CTRL(idx) + 0x04);
++ rcidx[idx] = mt76_rr(dev, MT_DBG_RX_DATA_RING_CTRL(idx) + 0x08);
++ rdidx[idx] = mt76_rr(dev, MT_DBG_RX_DATA_RING_CTRL(idx) + 0x0c);
++ } else {
++ rbase[idx] = mt76_rr(dev, MT_DBG_RX_EVENT_RING_CTRL(idx - 2));
++ rcnt[idx] = mt76_rr(dev, MT_DBG_RX_EVENT_RING_CTRL(idx - 2) + 0x04);
++ rcidx[idx] = mt76_rr(dev, MT_DBG_RX_EVENT_RING_CTRL(idx - 2) + 0x08);
++ rdidx[idx] = mt76_rr(dev, MT_DBG_RX_EVENT_RING_CTRL(idx - 2) + 0x0c);
++ }
++ }
++
++ seq_printf(s, "=================================================\n");
++ seq_printf(s, "TxRing Configuration\n");
++ seq_printf(s, "%4s %10s %8s %1s %6s %6s %6s %6s\n",
++ "Idx", "Attr", "Reg", "Base", "Cnt", "CIDX", "DIDX",
++ "QCnt");
++ for (idx = 0; idx < tx_ring_num; idx++) {
++ u32 queue_cnt;
++
++ queue_cnt = (tcidx[idx] >= tdidx[idx]) ?
++ (tcidx[idx] - tdidx[idx]) :
++ (tcidx[idx] - tdidx[idx] + tcnt[idx]);
++ seq_printf(s, "%4d %8s %8x %10x %6x %6x %6x %6x\n",
++ idx, tx_ring_layout[idx].ring_info,
++ MT_DBG_TX_RING_CTRL(idx), tbase[idx],
++ tcnt[idx], tcidx[idx], tdidx[idx], queue_cnt);
++ }
++
++ seq_printf(s, "RxRing Configuration\n");
++ seq_printf(s, "%4s %10s %8s %10s %6s %6s %6s %6s\n",
++ "Idx", "Attr", "Reg", "Base", "Cnt", "CIDX", "DIDX",
++ "QCnt");
++
++ for (idx = 0; idx < rx_ring_num; idx++) {
++ u32 queue_cnt;
++
++ queue_cnt = (rdidx[idx] > rcidx[idx]) ?
++ (rdidx[idx] - rcidx[idx] - 1) :
++ (rdidx[idx] - rcidx[idx] + rcnt[idx] - 1);
++ seq_printf(s, "%4d %8s %8x %10x %6x %6x %6x %6x\n",
++ idx, rx_ring_layout[idx].ring_info,
++ (idx < 2) ? MT_DBG_RX_DATA_RING_CTRL(idx): MT_DBG_RX_EVENT_RING_CTRL(idx - 2),
++ rbase[idx], rcnt[idx], rcidx[idx], rdidx[idx], queue_cnt);
++ }
++
++ mt7915_show_dma_info(s, dev);
++ return 0;
++}
++
++static int mt7915_drr_info(struct seq_file *s, void *data)
++{
++#define DL_AC_START 0x00
++#define DL_AC_END 0x0F
++#define UL_AC_START 0x10
++#define UL_AC_END 0x1F
++
++ struct mt7915_dev *dev = dev_get_drvdata(s->private);
++ u32 drr_sta_status[16];
++ u32 drr_ctrl_def_val = 0x80220000, drr_ctrl_val = 0;
++ bool is_show = false;
++ int idx, sta_line = 0, sta_no = 0, max_sta_line = (mt7915_wtbl_size(dev) + 31) / 32;
++ seq_printf(s, "DRR Table STA Info:\n");
++
++ for (idx = DL_AC_START; idx <= DL_AC_END; idx++) {
++ is_show = true;
++ drr_ctrl_val = (drr_ctrl_def_val | idx);
++ mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
++ drr_sta_status[0] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
++ drr_sta_status[1] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
++ drr_sta_status[2] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
++ drr_sta_status[3] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
++ drr_sta_status[4] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
++ drr_sta_status[5] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
++ drr_sta_status[6] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
++ drr_sta_status[7] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
++
++ if (is_mt7915(&dev->mt76) && max_sta_line > 8) {
++ drr_ctrl_val = (drr_ctrl_def_val | idx | 1 << 10);
++ mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
++ drr_sta_status[8] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
++ drr_sta_status[9] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
++ drr_sta_status[10] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
++ drr_sta_status[11] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
++ drr_sta_status[12] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
++ drr_sta_status[13] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
++ drr_sta_status[14] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
++ drr_sta_status[15] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
++ }
++ if (!is_mt7915(&dev->mt76))
++ max_sta_line = 8;
++
++ for (sta_line = 0; sta_line < max_sta_line; sta_line++) {
++ if (drr_sta_status[sta_line] > 0) {
++ for (sta_no = 0; sta_no < 32; sta_no++) {
++ if (((drr_sta_status[sta_line] & (0x1 << sta_no)) >> sta_no)) {
++ if (is_show) {
++ seq_printf(s, "\n DL AC%02d Queue Non-Empty STA:\n", idx);
++ is_show = false;
++ }
++ seq_printf(s, "%d ", sta_no + (sta_line * 32));
++ }
++ }
++ }
++ }
++ }
++
++ for (idx = UL_AC_START; idx <= UL_AC_END; idx++) {
++ is_show = true;
++ drr_ctrl_val = (drr_ctrl_def_val | idx);
++ mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
++ drr_sta_status[0] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
++ drr_sta_status[1] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
++ drr_sta_status[2] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
++ drr_sta_status[3] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
++ drr_sta_status[4] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
++ drr_sta_status[5] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
++ drr_sta_status[6] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
++ drr_sta_status[7] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
++
++ if (is_mt7915(&dev->mt76) && max_sta_line > 8) {
++ drr_ctrl_val = (drr_ctrl_def_val | idx | 1 << 10);
++ mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
++ drr_sta_status[8] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
++ drr_sta_status[9] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
++ drr_sta_status[10] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
++ drr_sta_status[11] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
++ drr_sta_status[12] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
++ drr_sta_status[13] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
++ drr_sta_status[14] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
++ drr_sta_status[15] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
++ }
++
++ if (!is_mt7915(&dev->mt76))
++ max_sta_line = 8;
++
++ for (sta_line = 0; sta_line < max_sta_line; sta_line++) {
++ if (drr_sta_status[sta_line] > 0) {
++ for (sta_no = 0; sta_no < 32; sta_no++) {
++ if (((drr_sta_status[sta_line] & (0x1 << sta_no)) >> sta_no)) {
++ if (is_show) {
++ seq_printf(s, "\n UL AC%02d Queue Non-Empty STA:\n", idx);
++ is_show = false;
++ }
++ seq_printf(s, "%d ", sta_no + (sta_line * 32));
++ }
++ }
++ }
++ }
++ }
++
++ for (idx = DL_AC_START; idx <= DL_AC_END; idx++) {
++ drr_ctrl_def_val = 0x80420000;
++ drr_ctrl_val = (drr_ctrl_def_val | idx);
++ mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
++ drr_sta_status[0] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
++ drr_sta_status[1] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
++ drr_sta_status[2] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
++ drr_sta_status[3] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
++ drr_sta_status[4] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
++ drr_sta_status[5] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
++ drr_sta_status[6] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
++ drr_sta_status[7] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
++
++ if (is_mt7915(&dev->mt76) && max_sta_line > 8) {
++ drr_ctrl_val = (drr_ctrl_def_val | idx | 1<<10);
++ mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
++ drr_sta_status[8] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
++ drr_sta_status[9] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
++ drr_sta_status[10] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
++ drr_sta_status[11] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
++ drr_sta_status[12] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
++ drr_sta_status[13] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
++ drr_sta_status[14] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
++ drr_sta_status[15] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
++ }
++
++ seq_printf(s, "\nBSSGrp[%d]:\n", idx);
++ if (!is_mt7915(&dev->mt76))
++ max_sta_line = 8;
++
++ for (sta_line = 0; sta_line < max_sta_line; sta_line++) {
++ seq_printf(s, "0x%08x ", drr_sta_status[sta_line]);
++
++ if ((sta_line % 4) == 3)
++ seq_printf(s, "\n");
++ }
++ }
++
++ return 0;
++}
++
++#define CR_NUM_OF_AC 17
++
++typedef enum _ENUM_UMAC_PORT_T {
++ ENUM_UMAC_HIF_PORT_0 = 0,
++ ENUM_UMAC_CPU_PORT_1 = 1,
++ ENUM_UMAC_LMAC_PORT_2 = 2,
++ ENUM_PLE_CTRL_PSE_PORT_3 = 3,
++ ENUM_UMAC_PSE_PLE_PORT_TOTAL_NUM = 4
++} ENUM_UMAC_PORT_T, *P_ENUM_UMAC_PORT_T;
++
++/* N9 MCU QUEUE LIST */
++typedef enum _ENUM_UMAC_CPU_P_QUEUE_T {
++ ENUM_UMAC_CTX_Q_0 = 0,
++ ENUM_UMAC_CTX_Q_1 = 1,
++ ENUM_UMAC_CTX_Q_2 = 2,
++ ENUM_UMAC_CTX_Q_3 = 3,
++ ENUM_UMAC_CRX = 0,
++ ENUM_UMAC_CIF_QUEUE_TOTAL_NUM = 4
++} ENUM_UMAC_CPU_P_QUEUE_T, *P_ENUM_UMAC_CPU_P_QUEUE_T;
++
++/* LMAC PLE TX QUEUE LIST */
++typedef enum _ENUM_UMAC_LMAC_PLE_TX_P_QUEUE_T {
++ ENUM_UMAC_LMAC_PLE_TX_Q_00 = 0x00,
++ ENUM_UMAC_LMAC_PLE_TX_Q_01 = 0x01,
++ ENUM_UMAC_LMAC_PLE_TX_Q_02 = 0x02,
++ ENUM_UMAC_LMAC_PLE_TX_Q_03 = 0x03,
++
++ ENUM_UMAC_LMAC_PLE_TX_Q_10 = 0x04,
++ ENUM_UMAC_LMAC_PLE_TX_Q_11 = 0x05,
++ ENUM_UMAC_LMAC_PLE_TX_Q_12 = 0x06,
++ ENUM_UMAC_LMAC_PLE_TX_Q_13 = 0x07,
++
++ ENUM_UMAC_LMAC_PLE_TX_Q_20 = 0x08,
++ ENUM_UMAC_LMAC_PLE_TX_Q_21 = 0x09,
++ ENUM_UMAC_LMAC_PLE_TX_Q_22 = 0x0a,
++ ENUM_UMAC_LMAC_PLE_TX_Q_23 = 0x0b,
++
++ ENUM_UMAC_LMAC_PLE_TX_Q_30 = 0x0c,
++ ENUM_UMAC_LMAC_PLE_TX_Q_31 = 0x0d,
++ ENUM_UMAC_LMAC_PLE_TX_Q_32 = 0x0e,
++ ENUM_UMAC_LMAC_PLE_TX_Q_33 = 0x0f,
++
++ ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_0 = 0x10,
++ ENUM_UMAC_LMAC_PLE_TX_Q_BMC_0 = 0x11,
++ ENUM_UMAC_LMAC_PLE_TX_Q_BNC_0 = 0x12,
++ ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_0 = 0x13,
++
++ ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_1 = 0x14,
++ ENUM_UMAC_LMAC_PLE_TX_Q_BMC_1 = 0x15,
++ ENUM_UMAC_LMAC_PLE_TX_Q_BNC_1 = 0x16,
++ ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_1 = 0x17,
++ ENUM_UMAC_LMAC_PLE_TX_Q_NAF = 0x18,
++ ENUM_UMAC_LMAC_PLE_TX_Q_NBCN = 0x19,
++ ENUM_UMAC_LMAC_PLE_TX_Q_RELEASE = 0x1f, /* DE suggests not to use 0x1f, it's only for hw free queue */
++ ENUM_UMAC_LMAC_QUEUE_TOTAL_NUM = 24,
++
++} ENUM_UMAC_LMAC_TX_P_QUEUE_T, *P_ENUM_UMAC_LMAC_TX_P_QUEUE_T;
++
++typedef struct _EMPTY_QUEUE_INFO_T {
++ char *QueueName;
++ u32 Portid;
++ u32 Queueid;
++} EMPTY_QUEUE_INFO_T, *P_EMPTY_QUEUE_INFO_T;
++
++static EMPTY_QUEUE_INFO_T ple_queue_empty_info[] = {
++ {"CPU Q0", ENUM_UMAC_CPU_PORT_1, ENUM_UMAC_CTX_Q_0},
++ {"CPU Q1", ENUM_UMAC_CPU_PORT_1, ENUM_UMAC_CTX_Q_1},
++ {"CPU Q2", ENUM_UMAC_CPU_PORT_1, ENUM_UMAC_CTX_Q_2},
++ {"CPU Q3", ENUM_UMAC_CPU_PORT_1, ENUM_UMAC_CTX_Q_3},
++ {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, /* 4~7 not defined */
++ {"ALTX Q0", ENUM_UMAC_LMAC_PORT_2, ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_0}, /* Q16 */
++ {"BMC Q0", ENUM_UMAC_LMAC_PORT_2, ENUM_UMAC_LMAC_PLE_TX_Q_BMC_0},
++ {"BCN Q0", ENUM_UMAC_LMAC_PORT_2, ENUM_UMAC_LMAC_PLE_TX_Q_BNC_0},
++ {"PSMP Q0", ENUM_UMAC_LMAC_PORT_2, ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_0},
++ {"ALTX Q1", ENUM_UMAC_LMAC_PORT_2, ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_1},
++ {"BMC Q1", ENUM_UMAC_LMAC_PORT_2, ENUM_UMAC_LMAC_PLE_TX_Q_BMC_1},
++ {"BCN Q1", ENUM_UMAC_LMAC_PORT_2, ENUM_UMAC_LMAC_PLE_TX_Q_BNC_1},
++ {"PSMP Q1", ENUM_UMAC_LMAC_PORT_2, ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_1},
++ {"NAF Q", ENUM_UMAC_LMAC_PORT_2, ENUM_UMAC_LMAC_PLE_TX_Q_NAF},
++ {"NBCN Q", ENUM_UMAC_LMAC_PORT_2, ENUM_UMAC_LMAC_PLE_TX_Q_NBCN},
++ {NULL, 0, 0}, {NULL, 0, 0}, /* 18, 19 not defined */
++ {"FIXFID Q", ENUM_UMAC_LMAC_PORT_2, 0x1a},
++ {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0},
++ {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, /* 21~29 not defined */
++ {"RLS Q", ENUM_PLE_CTRL_PSE_PORT_3, 0x7e},
++ {"RLS2 Q", ENUM_PLE_CTRL_PSE_PORT_3, 0x7f}
++};
++
++static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
++ {"AC00Q", ENUM_UMAC_LMAC_PORT_2, 0x40},
++ {"AC01Q", ENUM_UMAC_LMAC_PORT_2, 0x41},
++ {"AC02Q", ENUM_UMAC_LMAC_PORT_2, 0x42},
++ {"AC03Q", ENUM_UMAC_LMAC_PORT_2, 0x43},
++ {"AC10Q", ENUM_UMAC_LMAC_PORT_2, 0x44},
++ {"AC11Q", ENUM_UMAC_LMAC_PORT_2, 0x45},
++ {"AC12Q", ENUM_UMAC_LMAC_PORT_2, 0x46},
++ {"AC13Q", ENUM_UMAC_LMAC_PORT_2, 0x47},
++ {"AC20Q", ENUM_UMAC_LMAC_PORT_2, 0x48},
++ {"AC21Q", ENUM_UMAC_LMAC_PORT_2, 0x49},
++ {"AC22Q", ENUM_UMAC_LMAC_PORT_2, 0x4a},
++ {"AC23Q", ENUM_UMAC_LMAC_PORT_2, 0x4b},
++ {"AC30Q", ENUM_UMAC_LMAC_PORT_2, 0x4c},
++ {"AC31Q", ENUM_UMAC_LMAC_PORT_2, 0x4d},
++ {"AC32Q", ENUM_UMAC_LMAC_PORT_2, 0x4e},
++ {"AC33Q", ENUM_UMAC_LMAC_PORT_2, 0x4f},
++ {"ALTX Q0", ENUM_UMAC_LMAC_PORT_2, 0x50},
++ {"TF Q0", ENUM_UMAC_LMAC_PORT_2, 0x51},
++ {"TWT TSF-TF Q0", ENUM_UMAC_LMAC_PORT_2, 0x52},
++ {"TWT DL Q0", ENUM_UMAC_LMAC_PORT_2, 0x53},
++ {"TWT UL Q0", ENUM_UMAC_LMAC_PORT_2, 0x54},
++ {"ALTX Q1", ENUM_UMAC_LMAC_PORT_2, 0x55},
++ {"TF Q1", ENUM_UMAC_LMAC_PORT_2, 0x56},
++ {"TWT TSF-TF Q1", ENUM_UMAC_LMAC_PORT_2, 0x57},
++ {"TWT DL Q1", ENUM_UMAC_LMAC_PORT_2, 0x58},
++ {"TWT UL Q1", ENUM_UMAC_LMAC_PORT_2, 0x59},
++ {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0},
++};
++
++
++
++static char* sta_ctrl_reg[] = {"ENABLE", "DISABLE", "PAUSE"};
++static u32 chip_show_sta_acq_info(struct seq_file *s, struct mt7915_dev *dev, u32 *ple_stat,
++ u32 *sta_pause, u32 *dis_sta_map,
++ u32 dumptxd)
++{
++ int i, j;
++ u32 total_nonempty_cnt = 0;
++ u32 ac_num = 9, all_ac_num;
++
++ /* TDO: ac_num = 16 for mt7986 */
++ if (!is_mt7915(&dev->mt76))
++ ac_num = 17;
++
++ all_ac_num = ac_num * 4;
++
++ for (j = 0; j < all_ac_num; j++) { /* show AC Q info */
++ for (i = 0; i < 32; i++) {
++ if (((ple_stat[j + 1] & (0x1 << i)) >> i) == 0) {
++ u32 hfid, tfid, pktcnt, ac_n = j / ac_num, ctrl = 0;
++ u32 sta_num = i + (j % ac_num) * 32, fl_que_ctrl[3] = {0};
++ //struct wifi_dev *wdev = wdev_search_by_wcid(pAd, sta_num);
++ u32 wmmidx = 0;
++ struct mt7915_sta *msta;
++ struct mt76_wcid *wcid;
++ struct ieee80211_sta *sta = NULL;
++
++ wcid = rcu_dereference(dev->mt76.wcid[sta_num]);
++ sta = wcid_to_sta(wcid);
++ if (!sta) {
++ printk("ERROR!! no found STA wcid=%d\n", sta_num);
++ continue;
++ }
++ msta = container_of(wcid, struct mt7915_sta, wcid);
++ wmmidx = msta->vif->mt76.wmm_idx;
++
++ seq_printf(s, "\tSTA%d AC%d: ", sta_num, ac_n);
++
++ fl_que_ctrl[0] |= MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK;
++ fl_que_ctrl[0] |= (ENUM_UMAC_LMAC_PORT_2 << MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT);
++ fl_que_ctrl[0] |= (ac_n << MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
++ fl_que_ctrl[0] |= sta_num;
++ mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL0, fl_que_ctrl[0]);
++ fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL2);
++ fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL3);
++ hfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK, fl_que_ctrl[1]);
++ tfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK, fl_que_ctrl[1]);
++ pktcnt = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK, fl_que_ctrl[2]);
++ seq_printf(s, "tail/head fid = 0x%03x/0x%03x, pkt cnt = 0x%03x",
++ tfid, hfid, pktcnt);
++
++ if (((sta_pause[j % 6] & 0x1 << i) >> i) == 1)
++ ctrl = 2;
++
++ if (((dis_sta_map[j % 6] & 0x1 << i) >> i) == 1)
++ ctrl = 1;
++
++ seq_printf(s, " ctrl = %s", sta_ctrl_reg[ctrl]);
++ seq_printf(s, " (wmmidx=%d)\n", wmmidx);
++
++ total_nonempty_cnt++;
++
++ // TODO
++ //if (pktcnt > 0 && dumptxd > 0)
++ // ShowTXDInfo(pAd, hfid);
++ }
++ }
++ }
++
++ return total_nonempty_cnt;
++}
++
++static void chip_show_txcmdq_info(struct seq_file *s, struct mt7915_dev *dev, u32 ple_txcmd_stat)
++{
++ int i;
++
++ seq_printf(s, "Nonempty TXCMD Q info:\n");
++ for (i = 0; i < 32; i++) {
++ if (((ple_txcmd_stat & (0x1 << i)) >> i) == 0) {
++ u32 hfid, tfid, pktcnt, fl_que_ctrl[3] = {0};
++
++ if (ple_txcmd_queue_empty_info[i].QueueName != NULL) {
++ seq_printf(s, "\t%s: ", ple_txcmd_queue_empty_info[i].QueueName);
++ fl_que_ctrl[0] |= MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK;
++ fl_que_ctrl[0] |= (ple_txcmd_queue_empty_info[i].Portid <<
++ MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT);
++ fl_que_ctrl[0] |= (ple_txcmd_queue_empty_info[i].Queueid <<
++ MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
++ } else
++ continue;
++
++ mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL0, fl_que_ctrl[0]);
++ fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL2);
++ fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL3);
++ hfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK, fl_que_ctrl[1]);
++ tfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK, fl_que_ctrl[1]);
++ pktcnt = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK, fl_que_ctrl[2]);
++ seq_printf(s, "tail/head fid = 0x%03x/0x%03x, pkt cnt = 0x%03x\n",
++ tfid, hfid, pktcnt);
++ }
++ }
++}
++
++static void chip_get_ple_acq_stat(struct mt7915_dev *dev, u32 *ple_stat)
++{
++ int i;
++ int cr_num = 9, all_cr_num;
++ u32 ac , index;
++
++ /* TDO: cr_num = 16 for mt7986 */
++ if(!is_mt7915(&dev->mt76))
++ cr_num = 17;
++
++ all_cr_num = cr_num * 4;
++
++ ple_stat[0] = mt76_rr(dev, MT_DBG_PLE_QUEUE_EMPTY);
++
++ for(i = 0; i < all_cr_num; i++) {
++ ac = i / cr_num;
++ index = i % cr_num;
++ ple_stat[i + 1] =
++ mt76_rr(dev, MT_DBG_PLE_AC_QEMPTY(ac, index));
++
++ }
++}
++
++static void chip_get_dis_sta_map(struct mt7915_dev *dev, u32 *dis_sta_map)
++{
++ int i;
++ u32 ac_num = 9;
++
++ /* TDO: ac_num = 16 for mt7986 */
++ if (!is_mt7915(&dev->mt76))
++ ac_num = 17;
++
++ for(i = 0; i < ac_num; i++) {
++ dis_sta_map[i] = mt76_rr(dev, MT_DBG_PLE_DIS_STA_MAP(i));
++ }
++}
++
++static void chip_get_sta_pause(struct mt7915_dev *dev, u32 *sta_pause)
++{
++ int i;
++ u32 ac_num = 9;
++
++ /* TDO: ac_num = 16 for mt7986 */
++ if (!is_mt7915(&dev->mt76))
++ ac_num = 17;
++
++ for(i = 0; i < ac_num; i++) {
++ sta_pause[i] = mt76_rr(dev, MT_DBG_PLE_STATION_PAUSE(i));
++ }
++}
++
++static int mt7915_pleinfo_read(struct seq_file *s, void *data)
++{
++ struct mt7915_dev *dev = dev_get_drvdata(s->private);
++ u32 ple_buf_ctrl, pg_sz, pg_num;
++ u32 ple_stat[70] = {0}, pg_flow_ctrl[8] = {0};
++ u32 ple_native_txcmd_stat;
++ u32 ple_txcmd_stat;
++ u32 sta_pause[CR_NUM_OF_AC] = {0}, dis_sta_map[CR_NUM_OF_AC] = {0};
++ u32 fpg_cnt, ffa_cnt, fpg_head, fpg_tail, hif_max_q, hif_min_q;
++ u32 rpg_hif, upg_hif, cpu_max_q, cpu_min_q, rpg_cpu, upg_cpu;
++ int i, j;
++ u32 ac_num = 9, all_ac_num;
++
++ /* TDO: ac_num = 16 for mt7986 */
++ if (!is_mt7915(&dev->mt76))
++ ac_num = 17;
++
++ all_ac_num = ac_num * 4;
++
++ ple_buf_ctrl = mt76_rr(dev, MT_DBG_PLE_PBUF_CTRL_ADDR);
++ chip_get_ple_acq_stat(dev, ple_stat);
++ ple_txcmd_stat = mt76_rr(dev, MT_DBG_PLE_TXCMD_Q_EMPTY);
++ ple_native_txcmd_stat = mt76_rr(dev, MT_DBG_PLE_NATIVE_TXCMD_Q_EMPTY);
++ pg_flow_ctrl[0] = mt76_rr(dev, MT_DBG_PLE_FREEPG_CNT);
++ pg_flow_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FREEPG_HEAD_TAIL);
++ pg_flow_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_PG_HIF_GROUP);
++ pg_flow_ctrl[3] = mt76_rr(dev, MT_DBG_PLE_HIF_PG_INFO);
++ pg_flow_ctrl[4] = mt76_rr(dev, MT_DBG_PLE_PG_CPU_GROUP);
++ pg_flow_ctrl[5] = mt76_rr(dev, MT_DBG_PLE_CPU_PG_INFO);
++ pg_flow_ctrl[6] = mt76_rr(dev, MT_DBG_PLE_PG_HIF_TXCMD_GROUP);
++ pg_flow_ctrl[7] = mt76_rr(dev, MT_DBG_PLE_HIF_TXCMD_PG_INFO);
++ chip_get_dis_sta_map(dev, dis_sta_map);
++ chip_get_sta_pause(dev, sta_pause);
++
++ seq_printf(s, "PLE Configuration Info:\n");
++ seq_printf(s, "\tPacket Buffer Control(0x%x): 0x%08x\n",
++ MT_DBG_PLE_PBUF_CTRL_ADDR, ple_buf_ctrl);
++
++ pg_sz = FIELD_GET(MT_DBG_PLE_PBUF_CTRL_PAGE_SIZE_MASK, ple_buf_ctrl);
++ seq_printf(s, "\t\tPage Size=%d(%d bytes per page)\n",
++ pg_sz, (pg_sz == 1 ? 128 : 64));
++ seq_printf(s, "\t\tPage Offset=%ld(in unit of 2KB)\n",
++ FIELD_GET(MT_DBG_PLE_PBUF_CTRL_OFFSET_MASK, ple_buf_ctrl));
++
++ pg_num = FIELD_GET(MT_DBG_PLE_PBUF_CTRL_TOTAL_PAGE_NUM_MASK, ple_buf_ctrl);
++ seq_printf(s, "\t\tTotal Page=%d pages\n", pg_num);
++
++ /* Page Flow Control */
++ seq_printf(s, "PLE Page Flow Control:\n");
++ seq_printf(s, "\tFree page counter(0x%x): 0x%08x\n",
++ MT_DBG_PLE_FREEPG_CNT, pg_flow_ctrl[0]);
++ fpg_cnt = FIELD_GET(MT_DBG_PLE_FREEPG_CNT_FREEPG_CNT_MASK, pg_flow_ctrl[0]);
++
++ seq_printf(s, "\t\tThe toal page number of free=0x%03x\n", fpg_cnt);
++ ffa_cnt = FIELD_GET(MT_DBG_PLE_FREEPG_CNT_FFA_CNT_MASK, pg_flow_ctrl[0]);
++
++ seq_printf(s, "\t\tThe free page numbers of free for all=0x%03x\n", ffa_cnt);
++ seq_printf(s, "\tFree page head and tail(0x%x): 0x%08x\n",
++ MT_DBG_PLE_FREEPG_HEAD_TAIL, pg_flow_ctrl[1]);
++
++ fpg_head = FIELD_GET(MT_DBG_PLE_FREEPG_HEAD_TAIL_FREEPG_HEAD_MASK, pg_flow_ctrl[1]);
++ fpg_tail = FIELD_GET(MT_DBG_PLE_FREEPG_HEAD_TAIL_FREEPG_TAIL_MASK, pg_flow_ctrl[1]);
++ seq_printf(s, "\t\tThe tail/head page of free page list=0x%03x/0x%03x\n", fpg_tail, fpg_head);
++ seq_printf(s, "\tReserved page counter of HIF group(0x%x): 0x%08x\n",
++ MT_DBG_PLE_PG_HIF_GROUP, pg_flow_ctrl[2]);
++ seq_printf(s, "\tHIF group page status(0x%x): 0x%08x\n",
++ MT_DBG_PLE_HIF_PG_INFO, pg_flow_ctrl[3]);
++
++ hif_min_q = FIELD_GET(MT_DBG_PLE_PG_HIF_GROUP_HIF_MIN_QUOTA_MASK, pg_flow_ctrl[2]);
++ hif_max_q = FIELD_GET(MT_DBG_PLE_PG_HIF_GROUP_HIF_MAX_QUOTA_MASK, pg_flow_ctrl[2]);
++ seq_printf(s, "\t\tThe max/min quota pages of HIF group=0x%03x/0x%03x\n", hif_max_q, hif_min_q);
++
++ rpg_hif = FIELD_GET(MT_DBG_PLE_HIF_PG_INFO_HIF_RSV_CNT_MASK, pg_flow_ctrl[3]);
++ upg_hif = FIELD_GET(MT_DBG_PLE_HIF_PG_INFO_HIF_SRC_CNT_MASK, pg_flow_ctrl[3]);
++ seq_printf(s, "\t\tThe used/reserved pages of HIF group=0x%03x/0x%03x\n", upg_hif, rpg_hif);
++
++ seq_printf(s, "\tReserved page counter of HIF_TXCMD group(0x%x): 0x%08x\n",
++ MT_DBG_PLE_PG_HIF_TXCMD_GROUP, pg_flow_ctrl[6]);
++ seq_printf(s, "\tHIF_TXCMD group page status(0x%x): 0x%08x\n",
++ MT_DBG_PLE_HIF_TXCMD_PG_INFO, pg_flow_ctrl[7]);
++ cpu_min_q = FIELD_GET(MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MIN_QUOTA_MASK, pg_flow_ctrl[6]);
++ cpu_max_q = FIELD_GET(MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MAX_QUOTA_MASK, pg_flow_ctrl[6]);
++ seq_printf(s, "\t\tThe max/min quota pages of HIF_TXCMD group=0x%03x/0x%03x\n", cpu_max_q, cpu_min_q);
++
++ rpg_cpu = FIELD_GET(MT_DBG_PLE_TXCMD_PG_INFO_HIF_TXCMD_RSV_CNT_MASK, pg_flow_ctrl[7]);
++ upg_cpu = FIELD_GET(MT_DBG_PLE_TXCMD_PG_INFO_HIF_TXCMD_SRC_CNT_MASK, pg_flow_ctrl[7]);
++ seq_printf(s, "\t\tThe used/reserved pages of HIF_TXCMD group=0x%03x/0x%03x\n", upg_cpu, rpg_cpu);
++
++ seq_printf(s, "\tReserved page counter of CPU group(0x%x): 0x%08x\n",
++ MT_DBG_PLE_PG_CPU_GROUP, pg_flow_ctrl[4]);
++ seq_printf(s, "\tCPU group page status(0x%x): 0x%08x\n",
++ MT_DBG_PLE_CPU_PG_INFO, pg_flow_ctrl[5]);
++ cpu_min_q = FIELD_GET(MT_DBG_PLE_PG_CPU_GROUP_CPU_MIN_QUOTA_MASK, pg_flow_ctrl[4]);
++ cpu_max_q = FIELD_GET(MT_DBG_PLE_PG_CPU_GROUP_CPU_MAX_QUOTA_MASK, pg_flow_ctrl[4]);
++ seq_printf(s, "\t\tThe max/min quota pages of CPU group=0x%03x/0x%03x\n", cpu_max_q, cpu_min_q);
++
++ rpg_cpu = FIELD_GET(MT_DBG_PLE_CPU_PG_INFO_CPU_RSV_CNT_MASK, pg_flow_ctrl[5]);
++ upg_cpu = FIELD_GET(MT_DBG_PLE_CPU_PG_INFO_CPU_SRC_CNT_MASK, pg_flow_ctrl[5]);
++ seq_printf(s, "\t\tThe used/reserved pages of CPU group=0x%03x/0x%03x\n", upg_cpu, rpg_cpu);
++
++ if ((ple_stat[0] & MT_DBG_PLE_Q_EMPTY_ALL_AC_EMPTY_MASK) == 0) {
++ for (j = 0; j < all_ac_num; j++) {
++ if (j % ac_num == 0) {
++ seq_printf(s, "\n\tNonempty AC%d Q of STA#: ", j / ac_num);
++ }
++
++ for (i = 0; i < 32; i++) {
++ if (((ple_stat[j + 1] & (0x1 << i)) >> i) == 0) {
++ seq_printf(s, "%d ", i + (j % ac_num) * 32);
++ }
++ }
++ }
++
++ seq_printf(s, "\n");
++ }
++
++ seq_printf(s, "non-native/native txcmd queue empty = %d/%d\n", ple_txcmd_stat, ple_native_txcmd_stat);
++
++ seq_printf(s, "Nonempty Q info:\n");
++
++ for (i = 0; i < 32; i++) {
++ if (((ple_stat[0] & (0x1 << i)) >> i) == 0) {
++ u32 hfid, tfid, pktcnt, fl_que_ctrl[3] = {0};
++
++ if (ple_queue_empty_info[i].QueueName != NULL) {
++ seq_printf(s, "\t%s: ", ple_queue_empty_info[i].QueueName);
++ fl_que_ctrl[0] |= MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK;
++ fl_que_ctrl[0] |= (ple_queue_empty_info[i].Portid << MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT);
++ fl_que_ctrl[0] |= (ple_queue_empty_info[i].Queueid << MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
++ } else
++ continue;
++
++ if (ple_queue_empty_info[i].Queueid >= ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_0 &&
++ ple_queue_empty_info[i].Queueid <= ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_0)
++ /* band0 set TGID 0, bit31 = 0 */
++ mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL1, 0x0);
++ else if (ple_queue_empty_info[i].Queueid >= ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_1 &&
++ ple_queue_empty_info[i].Queueid <= ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_1)
++ /* band1 set TGID 1, bit31 = 1 */
++ mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL1, 0x80000000);
++
++ mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL0, fl_que_ctrl[0]);
++ fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL2);
++ fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL3);
++ hfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK, fl_que_ctrl[1]);
++ tfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK, fl_que_ctrl[1]);
++ pktcnt = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK, fl_que_ctrl[2]);
++ seq_printf(s, "tail/head fid = 0x%03x/0x%03x, pkt cnt = 0x%03x\n",
++ tfid, hfid, pktcnt);
++
++ /* TODO */
++ //if (pktcnt > 0 && dumptxd > 0)
++ // ShowTXDInfo(pAd, hfid);
++ }
++ }
++
++ chip_show_sta_acq_info(s, dev, ple_stat, sta_pause, dis_sta_map, 0/*dumptxd*/);
++ chip_show_txcmdq_info(s, dev, ple_native_txcmd_stat);
++
++ return 0;
++}
++
++typedef enum _ENUM_UMAC_PLE_CTRL_P3_QUEUE_T {
++ ENUM_UMAC_PLE_CTRL_P3_Q_0X1E = 0x1e,
++ ENUM_UMAC_PLE_CTRL_P3_Q_0X1F = 0x1f,
++ ENUM_UMAC_PLE_CTRL_P3_TOTAL_NUM = 2
++} ENUM_UMAC_PLE_CTRL_P3_QUEUE_T, *P_ENUM_UMAC_PLE_CTRL_P3_QUEUE_T;
++
++static EMPTY_QUEUE_INFO_T pse_queue_empty_info[] = {
++ {"CPU Q0", ENUM_UMAC_CPU_PORT_1, ENUM_UMAC_CTX_Q_0},
++ {"CPU Q1", ENUM_UMAC_CPU_PORT_1, ENUM_UMAC_CTX_Q_1},
++ {"CPU Q2", ENUM_UMAC_CPU_PORT_1, ENUM_UMAC_CTX_Q_2},
++ {"CPU Q3", ENUM_UMAC_CPU_PORT_1, ENUM_UMAC_CTX_Q_3},
++ {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, /* 4~7 not defined */
++ {"HIF Q0", ENUM_UMAC_HIF_PORT_0, 0}, /* Q8 */
++ {"HIF Q1", ENUM_UMAC_HIF_PORT_0, 1},
++ {"HIF Q2", ENUM_UMAC_HIF_PORT_0, 2},
++ {"HIF Q3", ENUM_UMAC_HIF_PORT_0, 3},
++ {"HIF Q4", ENUM_UMAC_HIF_PORT_0, 4},
++ {"HIF Q5", ENUM_UMAC_HIF_PORT_0, 5},
++ {NULL, 0, 0}, {NULL, 0, 0}, /* 14~15 not defined */
++ {"LMAC Q", ENUM_UMAC_LMAC_PORT_2, 0},
++ {"MDP TX Q", ENUM_UMAC_LMAC_PORT_2, 1},
++ {"MDP RX Q", ENUM_UMAC_LMAC_PORT_2, 2},
++ {"SEC TX Q", ENUM_UMAC_LMAC_PORT_2, 3},
++ {"SEC RX Q", ENUM_UMAC_LMAC_PORT_2, 4},
++ {"SFD_PARK Q", ENUM_UMAC_LMAC_PORT_2, 5},
++ {"MDP_TXIOC Q", ENUM_UMAC_LMAC_PORT_2, 6},
++ {"MDP_RXIOC Q", ENUM_UMAC_LMAC_PORT_2, 7},
++ {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, /* 24~30 not defined */
++ {"RLS Q", ENUM_PLE_CTRL_PSE_PORT_3, ENUM_UMAC_PLE_CTRL_P3_Q_0X1F}
++};
++
++static int mt7915_pseinfo_read(struct seq_file *s, void *data)
++{
++ struct mt7915_dev *dev = dev_get_drvdata(s->private);
++ u32 pse_buf_ctrl, pg_sz, pg_num;
++ u32 pse_stat, pg_flow_ctrl[22] = {0};
++ u32 fpg_cnt, ffa_cnt, fpg_head, fpg_tail;
++ u32 max_q, min_q, rsv_pg, used_pg;
++ int i;
++
++ pse_buf_ctrl = mt76_rr(dev, MT_DBG_PSE_PBUF_CTRL);
++ pse_stat = mt76_rr(dev, MT_DBG_PSE_QUEUE_EMPTY);
++ pg_flow_ctrl[0] = mt76_rr(dev, MT_DBG_PSE_FREEPG_CNT);
++ pg_flow_ctrl[1] = mt76_rr(dev, MT_DBG_PSE_FREEPG_HEAD_TAIL);
++ pg_flow_ctrl[2] = mt76_rr(dev, MT_DBG_PSE_PG_HIF0_GROUP);
++ pg_flow_ctrl[3] = mt76_rr(dev, MT_DBG_PSE_HIF0_PG_INFO);
++ pg_flow_ctrl[4] = mt76_rr(dev, MT_DBG_PSE_PG_HIF1_GROUP);
++ pg_flow_ctrl[5] = mt76_rr(dev, MT_DBG_PSE_HIF1_PG_INFO);
++ pg_flow_ctrl[6] = mt76_rr(dev, MT_DBG_PSE_PG_CPU_GROUP);
++ pg_flow_ctrl[7] = mt76_rr(dev, MT_DBG_PSE_CPU_PG_INFO);
++ pg_flow_ctrl[8] = mt76_rr(dev, MT_DBG_PSE_PG_LMAC0_GROUP);
++ pg_flow_ctrl[9] = mt76_rr(dev, MT_DBG_PSE_LMAC0_PG_INFO);
++ pg_flow_ctrl[10] = mt76_rr(dev, MT_DBG_PSE_PG_LMAC1_GROUP);
++ pg_flow_ctrl[11] = mt76_rr(dev, MT_DBG_PSE_LMAC1_PG_INFO);
++ pg_flow_ctrl[12] = mt76_rr(dev, MT_DBG_PSE_PG_LMAC2_GROUP);
++ pg_flow_ctrl[13] = mt76_rr(dev, MT_DBG_PSE_LMAC2_PG_INFO);
++ pg_flow_ctrl[14] = mt76_rr(dev, MT_DBG_PSE_PG_PLE_GROUP);
++ pg_flow_ctrl[15] = mt76_rr(dev, MT_DBG_PSE_PLE_PG_INFO);
++ pg_flow_ctrl[16] = mt76_rr(dev, MT_DBG_PSE_PG_LMAC3_GROUP);
++ pg_flow_ctrl[17] = mt76_rr(dev, MT_DBG_PSE_LMAC3_PG_INFO);
++ pg_flow_ctrl[18] = mt76_rr(dev, MT_DBG_PSE_PG_MDP_GROUP);
++ pg_flow_ctrl[19] = mt76_rr(dev, MT_DBG_PSE_MDP_PG_INFO);
++ pg_flow_ctrl[20] = mt76_rr(dev, MT_DBG_PSE_PG_PLE1_GROUP);
++ pg_flow_ctrl[21] = mt76_rr(dev,MT_DBG_PSE_PLE1_PG_INFO);
++
++ /* Configuration Info */
++ seq_printf(s, "PSE Configuration Info:\n");
++ seq_printf(s, "\tPacket Buffer Control(0x82068014): 0x%08x\n", pse_buf_ctrl);
++ pg_sz = FIELD_GET(MT_DBG_PSE_PBUF_CTRL_PAGE_SIZE_CFG_MASK, pse_buf_ctrl);
++
++ seq_printf(s, "\t\tPage Size=%d(%d bytes per page)\n", pg_sz, (pg_sz == 1 ? 256 : 128));
++ seq_printf(s, "\t\tPage Offset=%ld(in unit of 64KB)\n",
++ FIELD_GET(MT_DBG_PSE_PBUF_CTRL_PBUF_OFFSET_MASK, pse_buf_ctrl));
++ pg_num = FIELD_GET(MT_DBG_PSE_PBUF_CTRL_TOTAL_PAGE_NUM_MASK, pse_buf_ctrl);
++
++ seq_printf(s, "\t\tTotal page numbers=%d pages\n", pg_num);
++
++ /* Page Flow Control */
++ seq_printf(s, "PSE Page Flow Control:\n");
++ seq_printf(s, "\tFree page counter(0x82068100): 0x%08x\n", pg_flow_ctrl[0]);
++ fpg_cnt = FIELD_GET(MT_DBG_PSE_FREEPG_CNT_FREEPG_CNT_MASK, pg_flow_ctrl[0]);
++ seq_printf(s, "\t\tThe toal page number of free=0x%03x\n", fpg_cnt);
++
++ ffa_cnt = FIELD_GET(MT_DBG_PSE_FREEPG_CNT_FFA_CNT_MASK, pg_flow_ctrl[0]);
++ seq_printf(s, "\t\tThe free page numbers of free for all=0x%03x\n", ffa_cnt);
++
++ seq_printf(s, "\tFree page head and tail(0x82068104): 0x%08x\n", pg_flow_ctrl[1]);
++ fpg_head = FIELD_GET(MT_DBG_PSE_FREEPG_HEAD_TAIL_FREEPG_HEAD_MASK, pg_flow_ctrl[1]);
++
++ fpg_tail = FIELD_GET(MT_DBG_PSE_FREEPG_HEAD_TAIL_FREEPG_TAIL_MASK, pg_flow_ctrl[1]);
++ seq_printf(s, "\t\tThe tail/head page of free page list=0x%03x/0x%03x\n", fpg_tail, fpg_head);
++ seq_printf(s, "\tReserved page counter of HIF0 group(0x82068110): 0x%08x\n", pg_flow_ctrl[2]);
++ seq_printf(s, "\tHIF0 group page status(0x82068114): 0x%08x\n", pg_flow_ctrl[3]);
++ min_q = FIELD_GET(MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MIN_QUOTA_MASK, pg_flow_ctrl[2]);
++ max_q = FIELD_GET(MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MAX_QUOTA_MASK, pg_flow_ctrl[2]);
++ seq_printf(s, "\t\tThe max/min quota pages of HIF0 group=0x%03x/0x%03x\n", max_q, min_q);
++ rsv_pg = FIELD_GET(MT_DBG_PSE_HIF0_PG_INFO_HIF0_RSV_CNT_MASK, pg_flow_ctrl[3]);;
++ used_pg = FIELD_GET(MT_DBG_PSE_HIF0_PG_INFO_HIF0_SRC_CNT_MASK, pg_flow_ctrl[3]);
++ seq_printf(s, "\t\tThe used/reserved pages of HIF0 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++ seq_printf(s, "\tReserved page counter of HIF1 group(0x82068118): 0x%08x\n", pg_flow_ctrl[4]);
++ seq_printf(s, "\tHIF1 group page status(0x8206811c): 0x%08x\n", pg_flow_ctrl[5]);
++ min_q = FIELD_GET(MT_DBG_PSE_PG_HIF1_GROUP_HIF1_MIN_QUOTA_MASK, pg_flow_ctrl[4]);
++ max_q = FIELD_GET(MT_DBG_PSE_PG_HIF1_GROUP_HIF1_MAX_QUOTA_MASK, pg_flow_ctrl[4]);
++ seq_printf(s, "\t\tThe max/min quota pages of HIF1 group=0x%03x/0x%03x\n", max_q, min_q);
++ rsv_pg = FIELD_GET(MT_DBG_PSE_HIF1_PG_INFO_HIF1_RSV_CNT_MASK, pg_flow_ctrl[5]);
++ used_pg = FIELD_GET(MT_DBG_PSE_HIF1_PG_INFO_HIF1_SRC_CNT_MASK, pg_flow_ctrl[5]);
++
++ seq_printf(s, "\t\tThe used/reserved pages of HIF1 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++ seq_printf(s, "\tReserved page counter of CPU group(0x82068150): 0x%08x\n", pg_flow_ctrl[6]);
++ seq_printf(s, "\tCPU group page status(0x82068154): 0x%08x\n", pg_flow_ctrl[7]);
++ min_q = FIELD_GET(MT_DBG_PSE_PG_CPU_GROUP_CPU_MIN_QUOTA_MASK, pg_flow_ctrl[6]);
++ max_q = FIELD_GET(MT_DBG_PSE_PG_CPU_GROUP_CPU_MAX_QUOTA_MASK, pg_flow_ctrl[6]);
++ seq_printf(s, "\t\tThe max/min quota pages of CPU group=0x%03x/0x%03x\n", max_q, min_q);
++ rsv_pg = FIELD_GET(MT_DBG_PSE_CPU_PG_INFO_CPU_RSV_CNT_MASK, pg_flow_ctrl[7]);
++ used_pg = FIELD_GET(MT_DBG_PSE_CPU_PG_INFO_CPU_SRC_CNT_MASK, pg_flow_ctrl[7]);
++ seq_printf(s, "\t\tThe used/reserved pages of CPU group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++ seq_printf(s, "\tReserved page counter of LMAC0 group(0x82068170): 0x%08x\n", pg_flow_ctrl[8]);
++ seq_printf(s, "\tLMAC0 group page status(0x82068174): 0x%08x\n", pg_flow_ctrl[9]);
++ min_q = FIELD_GET(MT_DBG_PSE_PG_LMAC0_GROUP_LMAC0_MIN_QUOTA_MASK, pg_flow_ctrl[8]);
++ max_q = FIELD_GET(MT_DBG_PSE_PG_LMAC0_GROUP_LMAC0_MAX_QUOTA_MASK, pg_flow_ctrl[8]);
++ seq_printf(s, "\t\tThe max/min quota pages of LMAC0 group=0x%03x/0x%03x\n", max_q, min_q);
++ rsv_pg = FIELD_GET(MT_DBG_PSE_LMAC0_PG_INFO_LMAC0_RSV_CNT_MASK, pg_flow_ctrl[9]);
++ used_pg = FIELD_GET(MT_DBG_PSE_LMAC0_PG_INFO_LMAC0_SRC_CNT_MASK, pg_flow_ctrl[9]);
++ seq_printf(s, "\t\tThe used/reserved pages of LMAC0 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++ seq_printf(s, "\tReserved page counter of LMAC1 group(0x82068178): 0x%08x\n", pg_flow_ctrl[10]);
++ seq_printf(s, "\tLMAC1 group page status(0x8206817c): 0x%08x\n", pg_flow_ctrl[11]);
++ min_q = FIELD_GET(MT_DBG_TOP_PG_LMAC1_GROUP_LMAC1_MIN_QUOTA_MASK, pg_flow_ctrl[10]);
++ max_q = FIELD_GET(MT_DBG_PSE_PG_LMAC1_GROUP_LMAC1_MAX_QUOTA_MASK, pg_flow_ctrl[10]);
++ seq_printf(s, "\t\tThe max/min quota pages of LMAC1 group=0x%03x/0x%03x\n", max_q, min_q);
++ rsv_pg = FIELD_GET(MT_DBG_PSE_LMAC1_PG_INFO_LMAC1_RSV_CNT_MASK, pg_flow_ctrl[11]);
++ used_pg = FIELD_GET(MT_DBG_PSE_LMAC1_PG_INFO_LMAC1_SRC_CNT_MASK, pg_flow_ctrl[11]);
++ seq_printf(s, "\t\tThe used/reserved pages of LMAC1 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++ seq_printf(s, "\tReserved page counter of LMAC2 group(0x82068180): 0x%08x\n", pg_flow_ctrl[11]);
++ seq_printf(s, "\tLMAC2 group page status(0x82068184): 0x%08x\n", pg_flow_ctrl[12]);
++ min_q = FIELD_GET(MT_DBG_PSE_PG_LMAC2_GROUP_LMAC2_MIN_QUOTA_MASK, pg_flow_ctrl[12]);
++ max_q = FIELD_GET(MT_DBG_PSE_PG_LMAC2_GROUP_LMAC2_MAX_QUOTA_MASK, pg_flow_ctrl[12]);
++ seq_printf(s, "\t\tThe max/min quota pages of LMAC2 group=0x%03x/0x%03x\n", max_q, min_q);
++ rsv_pg = FIELD_GET(MT_DBG_PSE_LMAC2_PG_INFO_LMAC2_RSV_CNT_MASK, pg_flow_ctrl[13]);
++ used_pg = FIELD_GET(MT_DBG_PSE_LMAC2_PG_INFO_LMAC2_SRC_CNT_MASK, pg_flow_ctrl[13]);
++ seq_printf(s, "\t\tThe used/reserved pages of LMAC2 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++
++ seq_printf(s, "\tReserved page counter of LMAC3 group(0x82068188): 0x%08x\n", pg_flow_ctrl[16]);
++ seq_printf(s, "\tLMAC3 group page status(0x8206818c): 0x%08x\n", pg_flow_ctrl[17]);
++ min_q = FIELD_GET(MT_DBG_TOP_PG_LMAC3_GROUP_LMAC3_MIN_QUOTA_MASK, pg_flow_ctrl[16]);
++ max_q = FIELD_GET(MT_DBG_PSE_PG_LMAC3_GROUP_LMAC3_MAX_QUOTA_MASK, pg_flow_ctrl[16]);
++ seq_printf(s, "\t\tThe max/min quota pages of LMAC3 group=0x%03x/0x%03x\n", max_q, min_q);
++ rsv_pg = FIELD_GET(MT_DBG_PSE_LMAC3_PG_INFO_LMAC3_RSV_CNT_MASK, pg_flow_ctrl[17]);
++ used_pg = FIELD_GET(MT_DBG_PSE_LMAC3_PG_INFO_LMAC3_SRC_CNT_MASK, pg_flow_ctrl[17]);
++ seq_printf(s, "\t\tThe used/reserved pages of LMAC3 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++
++ seq_printf(s, "\tReserved page counter of PLE group(0x82068160): 0x%08x\n", pg_flow_ctrl[14]);
++ seq_printf(s, "\tPLE group page status(0x82068164): 0x%08x\n", pg_flow_ctrl[15]);
++ min_q = FIELD_GET(MT_DBG_PSE_PG_PLE_GROUP_PLE_MIN_QUOTA_MASK, pg_flow_ctrl[14]);
++ max_q = FIELD_GET(MT_DBG_PSE_PG_PLE_GROUP_PLE_MAX_QUOTA_MASK, pg_flow_ctrl[14]);
++ seq_printf(s, "\t\tThe max/min quota pages of PLE group=0x%03x/0x%03x\n", max_q, min_q);
++ rsv_pg = FIELD_GET(MT_DBG_PSE_PLE_PG_INFO_PLE_RSV_CNT_MASK, pg_flow_ctrl[15]);
++ used_pg = FIELD_GET(MT_DBG_PSE_PLE_PG_INFO_PLE_SRC_CNT_MASK, pg_flow_ctrl[15]);
++ seq_printf(s, "\t\tThe used/reserved pages of PLE group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++
++ seq_printf(s, "\tReserved page counter of PLE1 group(0x82068168): 0x%08x\n", pg_flow_ctrl[14]);
++ seq_printf(s, "\tPLE1 group page status(0x8206816c): 0x%08x\n", pg_flow_ctrl[15]);
++ min_q = FIELD_GET(MT_DBG_PSE_PG_PLE_GROUP_PLE_MIN_QUOTA_MASK, pg_flow_ctrl[20]);
++ max_q = FIELD_GET(MT_DBG_PSE_PG_PLE_GROUP_PLE_MAX_QUOTA_MASK, pg_flow_ctrl[20]);
++ seq_printf(s, "\t\tThe max/min quota pages of PLE1 group=0x%03x/0x%03x\n", max_q, min_q);
++ rsv_pg = FIELD_GET(MT_DBG_PSE_PLE_PG_INFO_PLE_RSV_CNT_MASK, pg_flow_ctrl[21]);
++ used_pg = FIELD_GET(MT_DBG_PSE_PLE_PG_INFO_PLE_SRC_CNT_MASK, pg_flow_ctrl[21]);
++ seq_printf(s, "\t\tThe used/reserved pages of PLE1 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++
++ seq_printf(s, "\tReserved page counter of MDP group(0x82068198): 0x%08x\n", pg_flow_ctrl[18]);
++ seq_printf(s, "\tMDP group page status(0x8206819c): 0x%08x\n", pg_flow_ctrl[19]);
++ min_q = FIELD_GET(MT_DBG_PSE_PG_MDP_GROUP_MDP_MIN_QUOTA_MASK, pg_flow_ctrl[18]);
++ max_q = FIELD_GET(MT_DBG_PSE_PG_MDP_GROUP_MDP_MAX_QUOTA_MASK, pg_flow_ctrl[18]);
++ seq_printf(s, "\t\tThe max/min quota pages of MDP group=0x%03x/0x%03x\n", max_q, min_q);
++ rsv_pg = FIELD_GET(MT_DBG_PSE_MDP_PG_INFO_MDP_RSV_CNT_MASK, pg_flow_ctrl[19]);
++ used_pg = FIELD_GET(MT_DBG_PSE_MDP_PG_INFO_MDP_SRC_CNT_MASK, pg_flow_ctrl[19]);
++ seq_printf(s, "\t\tThe used/reserved pages of MDP group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++
++ /* Queue Empty Status */
++ seq_printf(s, "PSE Queue Empty Status:\n");
++ seq_printf(s, "\tQUEUE_EMPTY(0x820680b0): 0x%08x\n", pse_stat);
++ seq_printf(s, "\t\tCPU Q0/1/2/3 empty=%ld/%ld/%ld/%ld\n",
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_CPU_Q0_EMPTY_MASK, pse_stat),
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_CPU_Q1_EMPTY_MASK, pse_stat),
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_CPU_Q2_EMPTY_MASK, pse_stat),
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_CPU_Q3_EMPTY_MASK, pse_stat));
++
++ seq_printf(s, "\t\tHIF Q0/1/2/3/4/5 empty=%ld/%ld/%ld/%ld/%ld/%ld\n",
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_0_EMPTY_MASK, pse_stat),
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_1_EMPTY_MASK, pse_stat),
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_2_EMPTY_MASK, pse_stat),
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_3_EMPTY_MASK, pse_stat),
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_4_EMPTY_MASK, pse_stat),
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_5_EMPTY_MASK, pse_stat));
++
++ seq_printf(s, "\t\tLMAC TX Q empty=%ld\n",
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_LMAC_TX_QUEUE_EMPTY_MASK, pse_stat));
++ seq_printf(s, "\t\tMDP TX Q/RX Q empty=%ld/%ld\n",
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_MDP_TX_QUEUE_EMPTY_MASK, pse_stat),
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_MDP_RX_QUEUE_EMPTY_MASK, pse_stat));
++ seq_printf(s, "\t\tSEC TX Q/RX Q empty=%ld/%ld\n",
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_SEC_TX_QUEUE_EMPTY_MASK, pse_stat),
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_SEC_RX_QUEUE_EMPTY_SHFT, pse_stat));
++ seq_printf(s, "\t\tSFD PARK Q empty=%ld\n",
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_SFD_PARK_QUEUE_EMPTY_MASK, pse_stat));
++ seq_printf(s, "\t\tMDP TXIOC Q/RXIOC Q empty=%ld/%ld\n",
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_MDP_TXIOC_QUEUE_EMPTY_MASK, pse_stat),
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_MDP_RXIOC_QUEUE_EMPTY_MASK, pse_stat));
++ seq_printf(s, "\t\tRLS Q empty=%ld\n",
++ FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_RLS_Q_EMTPY_MASK, pse_stat));
++ seq_printf(s, "Nonempty Q info:\n");
++
++ for (i = 0; i < 31; i++) {
++ if (((pse_stat & (0x1 << i)) >> i) == 0) {
++ u32 hfid, tfid, pktcnt, fl_que_ctrl[3] = {0};
++
++ if (pse_queue_empty_info[i].QueueName != NULL) {
++ seq_printf(s, "\t%s: ", pse_queue_empty_info[i].QueueName);
++ fl_que_ctrl[0] |= MT_DBG_PSE_FL_QUE_CTRL_0_EXECUTE_MASK;
++ fl_que_ctrl[0] |= (pse_queue_empty_info[i].Portid << MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_PID_SHFT);
++ fl_que_ctrl[0] |= (pse_queue_empty_info[i].Queueid << MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_QID_SHFT);
++ } else
++ continue;
++
++ fl_que_ctrl[0] |= (0x1 << 31);
++
++ mt76_wr(dev, MT_DBG_PSE_FL_QUE_CTRL_0_ADDR, fl_que_ctrl[0]);
++ fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PSE_FL_QUE_CTRL_2_ADDR);
++ fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PSE_FL_QUE_CTRL_3_ADDR);
++
++ hfid = FIELD_GET(MT_DBG_PSE_FL_QUE_CTRL_2_QUEUE_HEAD_FID_MASK, fl_que_ctrl[1]);
++ tfid = FIELD_GET(MT_DBG_PSE_FL_QUE_CTRL_2_QUEUE_TAIL_FID_MASK, fl_que_ctrl[1]);
++ pktcnt = FIELD_GET(MT_DBG_PSE_FL_QUE_CTRL_3_QUEUE_PKT_NUM_MASK, fl_que_ctrl[2]);
++ seq_printf(s, "tail/head fid = 0x%03x/0x%03x, pkt cnt = 0x%03x\n",
++ tfid, hfid, pktcnt);
++ }
++ }
++
++ return 0;
++}
++
++static int mt7915_mibinfo_read_per_band(struct seq_file *s, int band_idx)
++{
++#define BSS_NUM 4
++ struct mt7915_dev *dev = dev_get_drvdata(s->private);
++ u32 mac_val0, mac_val, mac_val1, idx, band_offset = 0;
++ u32 msdr6, msdr7, msdr8, msdr9, msdr10, msdr16, msdr17, msdr18, msdr19, msdr20, msdr21;
++ u32 mbxsdr[BSS_NUM][7];
++ u32 mbtcr[16], mbtbcr[16], mbrcr[16], mbrbcr[16];
++ u32 btcr[BSS_NUM], btbcr[BSS_NUM], brcr[BSS_NUM], brbcr[BSS_NUM], btdcr[BSS_NUM], brdcr[BSS_NUM];
++ u32 mu_cnt[5];
++ u32 ampdu_cnt[3];
++ unsigned long per;
++
++ seq_printf(s, "Band %d MIB Status\n", band_idx);
++ seq_printf(s, "===============================\n");
++ mac_val = mt76_rr(dev, MT_DBG_MIB_M0SCR0(band_idx));
++ seq_printf(s, "MIB Status Control=0x%x\n", mac_val);
++ if (is_mt7915(&dev->mt76)) {
++ mac_val = mt76_rr(dev, MT_DBG_MIB_M0PBSCR(band_idx));
++ seq_printf(s, "MIB Per-BSS Status Control=0x%x\n", mac_val);
++ }
++
++ msdr6 = mt76_rr(dev, MT_DBG_MIB_M0SDR6(band_idx));
++ msdr7 = mt76_rr(dev, MT_DBG_MIB_M0SDR7(band_idx));
++ msdr8 = mt76_rr(dev, MT_DBG_MIB_M0SDR8(band_idx));
++ msdr9 = mt76_rr(dev, MT_DBG_MIB_M0SDR9(band_idx));
++ msdr10 = mt76_rr(dev, MT_DBG_MIB_M0SDR10(band_idx));
++ msdr16 = mt76_rr(dev, MT_DBG_MIB_M0SDR16(band_idx));
++ msdr17 = mt76_rr(dev, MT_DBG_MIB_M0SDR17(band_idx));
++ msdr18 = mt76_rr(dev, MT_DBG_MIB_M0SDR18(band_idx));
++ msdr19 = mt76_rr(dev, MT_DBG_MIB_M0SDR19(band_idx));
++ msdr20 = mt76_rr(dev, MT_DBG_MIB_M0SDR20(band_idx));
++ msdr21 = mt76_rr(dev, MT_DBG_MIB_M0SDR21(band_idx));
++ ampdu_cnt[0] = mt76_rr(dev, MT_DBG_MIB_M0SDR12(band_idx));
++ ampdu_cnt[1] = mt76_rr(dev, MT_DBG_MIB_M0SDR14(band_idx));
++ ampdu_cnt[2] = mt76_rr(dev, MT_DBG_MIB_M0SDR15(band_idx));
++ ampdu_cnt[1] &= MT_DBG_MIB_M0SDR14_AMPDU_MASK;
++ ampdu_cnt[2] &= MT_DBG_MIB_M0SDR15_AMPDU_ACKED_MASK;
++
++ seq_printf(s, "===Phy/Timing Related Counters===\n");
++ seq_printf(s, "\tChannelIdleCnt=0x%x\n", msdr6 & BN0_WF_MIB_TOP_M0SDR6_CHANNEL_IDLE_COUNT_MASK);
++ seq_printf(s, "\tCCA_NAV_Tx_Time=0x%x\n", msdr9 & BN0_WF_MIB_TOP_M0SDR9_CCA_NAV_TX_TIME_MASK);
++ seq_printf(s, "\tRx_MDRDY_CNT=0x%lx\n", msdr10 & MT_DBG_MIB_M0SDR10_RX_MDRDY_COUNT_MASK);
++ seq_printf(s, "\tCCK_MDRDY_TIME=0x%x, OFDM_MDRDY_TIME=0x%x, OFDM_GREEN_MDRDY_TIME=0x%x\n",
++ msdr19 & BN0_WF_MIB_TOP_M0SDR19_CCK_MDRDY_TIME_MASK,
++ msdr20 & BN0_WF_MIB_TOP_M0SDR20_OFDM_LG_MIXED_VHT_MDRDY_TIME_MASK,
++ msdr21 & BN0_WF_MIB_TOP_M0SDR21_OFDM_GREEN_MDRDY_TIME_MASK);
++ seq_printf(s, "\tPrim CCA Time=0x%x\n", msdr16 & BN0_WF_MIB_TOP_M0SDR16_P_CCA_TIME_MASK);
++ seq_printf(s, "\tSec CCA Time=0x%x\n", msdr17 & BN0_WF_MIB_TOP_M0SDR17_S_CCA_TIME_MASK);
++ seq_printf(s, "\tPrim ED Time=0x%x\n", msdr18 & BN0_WF_MIB_TOP_M0SDR18_P_ED_TIME_MASK);
++
++ seq_printf(s, "===Tx Related Counters(Generic)===\n");
++ mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR0(band_idx));
++ dev->dbg.bcn_total_cnt[band_idx] += (mac_val & BN0_WF_MIB_TOP_M0SDR0_BEACONTXCOUNT_MASK);
++ seq_printf(s, "\tBeaconTxCnt=0x%x\n",dev->dbg.bcn_total_cnt[band_idx]);
++ dev->dbg.bcn_total_cnt[band_idx] = 0;
++ mac_val = mt76_rr(dev, MT_DBG_MIB_M0DR0(band_idx));
++ seq_printf(s, "\tTx 20MHz Cnt=0x%x\n", mac_val & BN0_WF_MIB_TOP_M0DR0_TX_20MHZ_CNT_MASK);
++ seq_printf(s, "\tTx 40MHz Cnt=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0DR0_TX_40MHZ_CNT_MASK) >> BN0_WF_MIB_TOP_M0DR0_TX_40MHZ_CNT_SHFT);
++ mac_val = mt76_rr(dev, MT_DBG_MIB_M0DR1(band_idx));
++ seq_printf(s, "\tTx 80MHz Cnt=0x%x\n", mac_val & BN0_WF_MIB_TOP_M0DR1_TX_80MHZ_CNT_MASK);
++ seq_printf(s, "\tTx 160MHz Cnt=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0DR1_TX_160MHZ_CNT_MASK) >> BN0_WF_MIB_TOP_M0DR1_TX_160MHZ_CNT_SHFT);
++ seq_printf(s, "\tAMPDU Cnt=0x%x\n", ampdu_cnt[0]);
++ seq_printf(s, "\tAMPDU MPDU Cnt=0x%x\n", ampdu_cnt[1]);
++ seq_printf(s, "\tAMPDU MPDU Ack Cnt=0x%x\n", ampdu_cnt[2]);
++ per = (ampdu_cnt[2] == 0 ? 0 : 1000 * (ampdu_cnt[1] - ampdu_cnt[2]) / ampdu_cnt[1]);
++ seq_printf(s, "\tAMPDU MPDU PER=%ld.%1ld%%\n", per / 10, per % 10);
++
++ seq_printf(s, "===MU Related Counters===\n");
++ mu_cnt[0] = mt76_rr(dev, MT_DBG_MIB_MUBF(band_idx));
++ mu_cnt[1] = mt76_rr(dev, MT_DBG_MIB_M0DR8(band_idx));
++ mu_cnt[2] = mt76_rr(dev, MT_DBG_MIB_M0DR9(band_idx));
++ mu_cnt[3] = mt76_rr(dev, MT_DBG_MIB_M0DR10(band_idx));
++ mu_cnt[4] = mt76_rr(dev, MT_DBG_MIB_M0DR11(band_idx));
++ seq_printf(s, "\tMUBF_TX_COUNT=0x%x\n", mu_cnt[0] & BN0_WF_MIB_TOP_M0SDR34_MUBF_TX_COUNT_MASK);
++ seq_printf(s, "\tMU_TX_MPDU_COUNT(Ok+Fail)=0x%x\n", mu_cnt[1]);
++ seq_printf(s, "\tMU_TX_OK_MPDU_COUNT=0x%x\n", mu_cnt[2]);
++ seq_printf(s, "\tMU_TO_SU_PPDU_COUNT=0x%x\n", mu_cnt[3] & BN0_WF_MIB_TOP_M0DR10_MU_FAIL_PPDU_CNT_MASK);
++ seq_printf(s, "\tSU_TX_OK_MPDU_COUNT=0x%x\n", mu_cnt[4]);
++
++ seq_printf(s, "===Rx Related Counters(Generic)===\n");
++ seq_printf(s, "\tVector Mismacth Cnt=0x%x\n", msdr7 & BN0_WF_MIB_TOP_M0SDR7_VEC_MISS_COUNT_MASK);
++ seq_printf(s, "\tDelimiter Fail Cnt=0x%x\n", msdr8 & BN0_WF_MIB_TOP_M0SDR8_DELIMITER_FAIL_COUNT_MASK);
++
++ mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR3(band_idx));
++ seq_printf(s, "\tRxFCSErrCnt=0x%lx\n", __DBG_FIELD_GET(DBG_MIB_RX_FCS_ERROR_COUNT, mac_val));
++ mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR4(band_idx));
++ seq_printf(s, "\tRxFifoFullCnt=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0SDR4_RX_FIFO_FULL_COUNT_MASK));
++ mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR11(band_idx));
++ seq_printf(s, "\tRxLenMismatch=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0SDR11_RX_LEN_MISMATCH_MASK));
++ mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR5(band_idx));
++ seq_printf(s, "\tRxMPDUCnt=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0SDR5_RX_MPDU_COUNT_MASK));
++ mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR22(band_idx));
++ seq_printf(s, "\tRx AMPDU Cnt=0x%x\n", mac_val);
++ /* TODO: shiang-MT7615, is MIB_M0SDR23 used for Rx total byte count for all or just AMPDU only??? */
++ mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR23(band_idx));
++ seq_printf(s, "\tRx Total ByteCnt=0x%x\n", mac_val);
++
++ if (is_mt7915(&dev->mt76)) {
++ band_offset = WF_WTBLON_TOP_B1BTCRn_ADDR - WF_WTBLON_TOP_B0BTCRn_ADDR;//check
++ seq_printf(s, "===Per-BSS Related Tx/Rx Counters===\n");
++ seq_printf(s, "BSS Idx TxCnt/DataCnt TxByteCnt RxCnt/DataCnt RxByteCnt\n");
++
++ for (idx = 0; idx < BSS_NUM; idx++) {
++ btcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BTCRn_ADDR + band_offset + idx * 4);
++ btbcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BTBCRn_ADDR + band_offset + idx * 4);
++ brcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BRCRn_ADDR + band_offset + idx * 4);
++ brbcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BRBCRn_ADDR + band_offset + idx * 4);
++ btdcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BTDCRn_ADDR + band_offset + idx * 4);
++ brdcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BRDCRn_ADDR + band_offset + idx * 4);
++ }
++
++ for (idx = 0; idx < BSS_NUM; idx++) {
++ seq_printf(s, "%d\t 0x%x/0x%x\t 0x%x \t 0x%x/0x%x \t 0x%x\n",
++ idx, btcr[idx], btdcr[idx], btbcr[idx],
++ brcr[idx], brdcr[idx], brbcr[idx]);
++ }
++
++ band_offset = (BN1_WF_MIB_TOP_BASE - BN0_WF_MIB_TOP_BASE) * band_idx;
++ seq_printf(s, "===Per-MBSS Related MIB Counters===\n");
++ seq_printf(s, "BSS Idx RTSTx/RetryCnt BAMissCnt AckFailCnt FrmRetry1/2/3Cnt\n");
++
++ for (idx = 0; idx < BSS_NUM; idx++) {
++ mbxsdr[idx][0] = mt76_rr(dev, BN0_WF_MIB_TOP_M0B0SDR0_ADDR + band_offset + idx * 0x10);
++ mbxsdr[idx][1] = mt76_rr(dev, BN0_WF_MIB_TOP_M0B0SDR1_ADDR + band_offset + idx * 0x10);
++ mbxsdr[idx][2] = mt76_rr(dev, BN0_WF_MIB_TOP_M0B0SDR2_ADDR + band_offset + idx * 0x10);
++ mbxsdr[idx][3] = mt76_rr(dev, BN0_WF_MIB_TOP_M0B0SDR3_ADDR + band_offset + idx * 0x10);
++ }
++
++ for (idx = 0; idx < BSS_NUM; idx++) {
++ seq_printf(s, "%d:\t0x%08x/0x%08x 0x%08x \t 0x%08x \t 0x%08x/0x%08x/0x%08x\n",
++ idx, (mbxsdr[idx][0] & BN0_WF_MIB_TOP_M0B0SDR0_RTSTXCOUNT_MASK),
++ (mbxsdr[idx][0] & BN0_WF_MIB_TOP_M0B0SDR0_RTSRETRYCOUNT_MASK) >> BN0_WF_MIB_TOP_M0B0SDR0_RTSRETRYCOUNT_SHFT,
++ (mbxsdr[idx][1] & BN0_WF_MIB_TOP_M0B0SDR1_BAMISSCOUNT_MASK),
++ (mbxsdr[idx][1] & BN0_WF_MIB_TOP_M0B0SDR1_ACKFAILCOUNT_MASK) >> BN0_WF_MIB_TOP_M0B0SDR1_ACKFAILCOUNT_SHFT,
++ (mbxsdr[idx][2] & BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRYCOUNT_MASK),
++ (mbxsdr[idx][2] & BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRY2COUNT_MASK) >> BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRY2COUNT_SHFT,
++ (mbxsdr[idx][3] & BN0_WF_MIB_TOP_M0B0SDR3_FRAMERETRY3COUNT_MASK));
++ }
++
++ band_offset = WF_WTBLON_TOP_B1BTCRn_ADDR - WF_WTBLON_TOP_B0BTCRn_ADDR;
++ seq_printf(s, "===Per-MBSS Related Tx/Rx Counters===\n");
++ seq_printf(s, "MBSSIdx TxCnt TxByteCnt RxCnt RxByteCnt\n");
++
++ for (idx = 0; idx < 16; idx++) {
++ mbtcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0MBTCRn_ADDR + band_offset + idx * 4);
++ mbtbcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0MBTBCRn_ADDR + band_offset + idx * 4);
++ mbrcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0MBRCRn_ADDR + band_offset + idx * 4);
++ mbrbcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0MBRBCRn_ADDR + band_offset + idx * 4);
++ }
++
++ for (idx = 0; idx < 16; idx++) {
++ seq_printf(s, "%d\t 0x%08x\t 0x%08x \t 0x%08x \t 0x%08x\n",
++ idx, mbtcr[idx], mbtbcr[idx], mbrcr[idx], mbrbcr[idx]);
++ }
++ return 0;
++ } else {
++ u32 btocr[BSS_NUM], mbtocr[16],mbrocr[16], brocr[BSS_NUM];
++ u8 bss_nums = BSS_NUM;
++
++ band_offset = (BN1_WF_MIB_TOP_BTOCR_ADDR - BN0_WF_MIB_TOP_BTOCR_ADDR) * band_idx;
++ seq_printf(s, "===Per-BSS Related Tx/Rx Counters===\n");
++ seq_printf(s, "BSS Idx TxCnt/DataCnt TxByteCnt RxCnt/DataCnt RxByteCnt\n");
++
++ for (idx = 0; idx < BSS_NUM; idx++) {
++ btocr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BTOCR_ADDR + band_offset + (idx >> 1) * 4));
++ btdcr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BTDCR_ADDR + band_offset + (idx >> 1) * 4));
++ btbcr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BTBCR_ADDR + band_offset + (idx * 4)));
++ brocr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BROCR_ADDR + band_offset + (idx >> 1) * 4));
++ brdcr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BRDCR_ADDR + band_offset + (idx >> 1) * 4));
++ brbcr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BRBCR_ADDR + band_offset + (idx * 4)));
++
++ if ((idx % 2) == 0) {
++ btocr[idx] = ((btocr[idx] & BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_SHFT);
++ btdcr[idx] = ((btdcr[idx] & BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2n_SHFT);
++ brocr[idx] = ((brocr[idx] & BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_SHFT);
++ brdcr[idx] = ((brdcr[idx] & BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2n_SHFT);
++ } else {
++ btocr[idx] = ((btocr[idx] & BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_SHFT);
++ btdcr[idx] = ((btdcr[idx] & BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2np1_SHFT);
++ brocr[idx] = ((brocr[idx] & BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_SHFT);
++ brdcr[idx] = ((brdcr[idx] & BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2np1_SHFT);
++ }
++ }
++
++ for (idx = 0; idx < BSS_NUM; idx++) {
++ seq_printf(s, "%d\t 0x%x/0x%x\t 0x%x \t 0x%x/0x%x \t 0x%x\n",
++ idx, btocr[idx], btdcr[idx], btbcr[idx], brocr[idx], brdcr[idx], brbcr[idx]);
++ }
++
++ band_offset = (BN1_WF_MIB_TOP_BASE - BN0_WF_MIB_TOP_BASE) * band_idx;
++ seq_printf(s, "===Per-MBSS Related MIB Counters===\n");
++ seq_printf(s, "BSS Idx RTSTx/RetryCnt BAMissCnt AckFailCnt FrmRetry1/2/3Cnt\n");
++
++ for (idx = 0; idx < BSS_NUM; idx++) {
++ mbxsdr[idx][0] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR0_ADDR + band_offset + ((idx >> 1) * 4));
++ mbxsdr[idx][1] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR1_ADDR + band_offset + ((idx >> 1) * 4));
++ mbxsdr[idx][2] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR2_ADDR + band_offset + ((idx >> 1) * 4));
++ mbxsdr[idx][3] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR3_ADDR + band_offset + ((idx >> 1) * 4));
++ mbxsdr[idx][4] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR4_ADDR + band_offset + ((idx >> 1) * 4));
++ mbxsdr[idx][5] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR5_ADDR + band_offset + ((idx >> 1) * 4));
++ mbxsdr[idx][6] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR6_ADDR + band_offset + ((idx >> 1) * 4));
++
++ if ((idx % 2) == 0) {
++ mbxsdr[idx][0] = ((mbxsdr[idx][0] & BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2n_SHFT);
++ mbxsdr[idx][1] = ((mbxsdr[idx][1] & BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2n_SHFT);
++ mbxsdr[idx][2] = ((mbxsdr[idx][2] & BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2n_SHFT);
++ mbxsdr[idx][3] = ((mbxsdr[idx][3] & BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2n_SHFT);
++ mbxsdr[idx][4] = ((mbxsdr[idx][4] & BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2n_SHFT);
++ mbxsdr[idx][5] = ((mbxsdr[idx][5] & BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2n_SHFT);
++ mbxsdr[idx][6] = ((mbxsdr[idx][6] & BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2n_SHFT);
++ } else {
++ mbxsdr[idx][0] = ((mbxsdr[idx][0] & BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2np1_SHFT);
++ mbxsdr[idx][1] = ((mbxsdr[idx][1] & BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2np1_SHFT);
++ mbxsdr[idx][2] = ((mbxsdr[idx][2] & BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2np1_SHFT);
++ mbxsdr[idx][3] = ((mbxsdr[idx][3] & BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2np1_SHFT);
++ mbxsdr[idx][4] = ((mbxsdr[idx][4] & BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2np1_SHFT);
++ mbxsdr[idx][5] = ((mbxsdr[idx][5] & BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2np1_SHFT);
++ mbxsdr[idx][6] = ((mbxsdr[idx][6] & BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2np1_SHFT);
++ }
++ }
++
++ for (idx = 0; idx < BSS_NUM; idx++) {
++ seq_printf(s, "%d:\t0x%x/0x%x 0x%x \t 0x%x \t 0x%x/0x%x/0x%x\n",
++ idx,
++ mbxsdr[idx][0], mbxsdr[idx][1], mbxsdr[idx][2], mbxsdr[idx][3],
++ mbxsdr[idx][4], mbxsdr[idx][5], mbxsdr[idx][6]);
++ }
++
++ band_offset = (BN1_WF_MIB_TOP_BTOCR_ADDR - BN0_WF_MIB_TOP_BTOCR_ADDR) * band_idx;
++ seq_printf(s, "===Per-MBSS Related Tx/Rx Counters===\n");
++ seq_printf(s, "MBSSIdx TxCnt TxByteCnt RxCnt RxByteCnt\n");
++
++ for (idx = 0; idx < 16; idx++) {
++ mbtocr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BTOCR_ADDR + band_offset + (((bss_nums >> 1) * 4) + ((idx >> 1) * 4)));
++ mbtbcr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BTBCR_ADDR + band_offset + (((bss_nums >> 1) * 4) + (idx * 4)));
++ mbrocr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BROCR_ADDR + band_offset + (((bss_nums >> 1) * 4) + ((idx >> 1) * 4)));
++ mbrbcr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BRBCR_ADDR + band_offset + (((bss_nums >> 1) * 4) + (idx * 4)));
++
++ if ((idx % 2) == 0) {
++ mbtocr[idx] = ((mbtocr[idx] & BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_SHFT);
++ mbrocr[idx] = ((mbrocr[idx] & BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_SHFT);
++ } else {
++ mbtocr[idx] = ((mbtocr[idx] & BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_SHFT);
++ mbrocr[idx] = ((mbrocr[idx] & BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_SHFT);
++ }
++ }
++
++ for (idx = 0; idx < 16; idx++) {
++ seq_printf(s, "%d\t 0x%08x\t 0x%08x \t 0x%08x \t 0x%08x\n",
++ idx, mbtocr[idx], mbtbcr[idx], mbrocr[idx], mbrbcr[idx]);
++ }
++ }
++
++ seq_printf(s, "===Dummy delimiter insertion result===\n");
++ mac_val0 = mt76_rr(dev, MT_DBG_MIB_M0DR11(band_idx));
++ mac_val = mt76_rr(dev, MT_DBG_MIB_M0DR6(band_idx));
++ mac_val1 = mt76_rr(dev, MT_DBG_MIB_M0DR7(band_idx));
++ seq_printf(s, "Range0 = %d\t Range1 = %d\t Range2 = %d\t Range3 = %d\t Range4 = %d\n",
++ (mac_val0 & BN0_WF_MIB_TOP_M0DR12_TX_DDLMT_RNG0_CNT_MASK),
++ (mac_val & BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG1_CNT_MASK),
++ (mac_val & BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG2_CNT_MASK) >> BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG2_CNT_SHFT,
++ (mac_val1 & BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG3_CNT_MASK),
++ (mac_val1 & BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG4_CNT_MASK) >> BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG4_CNT_SHFT);
++
++ return 0;
++}
++
++static int mt7915_mibinfo_band0(struct seq_file *s, void *data)
++{
++ mt7915_mibinfo_read_per_band(s, 0);
++ return 0;
++}
++
++static int mt7915_mibinfo_band1(struct seq_file *s, void *data)
++{
++ mt7915_mibinfo_read_per_band(s, 1);
++ return 0;
++}
++
++static int mt7915_token_read(struct seq_file *s, void *data)
++{
++ struct mt7915_dev *dev = dev_get_drvdata(s->private);
++ int id, count = 0;
++ struct mt76_txwi_cache *txwi;
++
++ seq_printf(s, "Cut through token:\n");
++ spin_lock_bh(&dev->mt76.token_lock);
++ idr_for_each_entry(&dev->mt76.token, txwi, id) {
++ seq_printf(s, "%4d ", id);
++ count++;
++ if (count % 8 == 0)
++ seq_printf(s, "\n");
++ }
++ spin_unlock_bh(&dev->mt76.token_lock);
++ seq_printf(s, "\n");
++
++ return 0;
++}
++
++struct txd_l {
++ u32 txd_0;
++ u32 txd_1;
++ u32 txd_2;
++ u32 txd_3;
++ u32 txd_4;
++ u32 txd_5;
++ u32 txd_6;
++ u32 txd_7;
++} __packed;
++
++char *pkt_ft_str[] = {"cut_through", "store_forward", "cmd", "PDA_FW_Download"};
++char *hdr_fmt_str[] = {
++ "Non-80211-Frame",
++ "Command-Frame",
++ "Normal-80211-Frame",
++ "enhanced-80211-Frame",
++};
++/* TMAC_TXD_1.hdr_format */
++#define TMI_HDR_FT_NON_80211 0x0
++#define TMI_HDR_FT_CMD 0x1
++#define TMI_HDR_FT_NOR_80211 0x2
++#define TMI_HDR_FT_ENH_80211 0x3
++
++void mt7915_dump_tmac_info(u8 *tmac_info)
++{
++ struct txd_l *txd = (struct txd_l *)tmac_info;
++
++ printk("txd raw data: size=%d\n", MT_TXD_SIZE);
++ print_hex_dump(KERN_ERR , "", DUMP_PREFIX_OFFSET, 16, 1, tmac_info, MT_TXD_SIZE, false);
++
++ printk("TMAC_TXD Fields:\n");
++ printk("\tTMAC_TXD_0:\n");
++
++ /* DW0 */
++ /* TX Byte Count [15:0] */
++ printk("\t\tTxByteCnt = %ld\n", FIELD_GET(MT_TXD0_TX_BYTES, txd->txd_0));
++
++ /* PKT_FT: Packet Format [24:23] */
++ printk("\t\tpkt_ft = %ld(%s)\n",
++ FIELD_GET(MT_TXD0_PKT_FMT, txd->txd_0),
++ pkt_ft_str[FIELD_GET(MT_TXD0_PKT_FMT, txd->txd_0)]);
++
++ /* Q_IDX [31:25] */
++ printk("\t\tQueID =0x%lx\n", FIELD_GET(MT_TXD0_Q_IDX, txd->txd_0));
++
++ printk("\tTMAC_TXD_1:\n");
++
++ /* DW1 */
++ /* WLAN Indec [9:0] */
++ printk("\t\tWlan Index = %ld\n", FIELD_GET(MT_TXD1_WLAN_IDX, txd->txd_1));
++
++ /* VTA [10] */
++ printk("\t\tVTA = %d\n", ((txd->txd_1 & MT_TXD1_VTA) ? 1 : 0));
++
++ /* HF: Header Format [17:16] */
++ printk("\t\tHdrFmt = %ld(%s)\n",
++ FIELD_GET(MT_TXD1_HDR_FORMAT, txd->txd_1),
++ FIELD_GET(MT_TXD1_HDR_FORMAT, txd->txd_1) < 4 ?
++ hdr_fmt_str[FIELD_GET(MT_TXD1_HDR_FORMAT, txd->txd_1)] : "N/A");
++
++ switch (FIELD_GET(MT_TXD1_HDR_FORMAT, txd->txd_1)) {
++ case TMI_HDR_FT_NON_80211:
++ /* MRD [11], EOSP [12], RMVL [13], VLAN [14], ETYPE [15] */
++ printk("\t\t\tMRD = %d, EOSP = %d,\
++ RMVL = %d, VLAN = %d, ETYP = %d\n",
++ (txd->txd_1 & MT_TXD1_MRD) ? 1 : 0,
++ (txd->txd_1 & MT_TXD1_EOSP) ? 1 : 0,
++ (txd->txd_1 & MT_TXD1_RMVL) ? 1 : 0,
++ (txd->txd_1 & MT_TXD1_VLAN) ? 1 : 0,
++ (txd->txd_1 & MT_TXD1_ETYP) ? 1 : 0);
++ break;
++ case TMI_HDR_FT_NOR_80211:
++ /* HEADER_LENGTH [15:11] */
++ printk("\t\t\tHeader Len = %ld(WORD)\n", FIELD_GET(MT_TXD1_HDR_INFO, txd->txd_1));
++ break;
++
++ case TMI_HDR_FT_ENH_80211:
++ /* EOSP [12], AMS [13] */
++ printk("\t\t\tEOSP = %d, AMS = %d\n",
++ (txd->txd_1 & MT_TXD1_EOSP) ? 1 : 0,
++ (txd->txd_1 & MT_TXD1_AMS) ? 1 : 0);
++ break;
++ }
++
++ /* Header Padding [19:18] */
++ printk("\t\tHdrPad = %ld\n", FIELD_GET(MT_TXD1_HDR_PAD, txd->txd_1));
++
++ /* TID [22:20] */
++ printk("\t\tTID = %ld\n", FIELD_GET(MT_TXD1_TID, txd->txd_1));
++
++
++ /* UtxB/AMSDU_C/AMSDU [23] */
++ printk("\t\tamsdu = %d\n", ((txd->txd_1 & MT_TXD1_AMSDU) ? 1 : 0));
++
++ /* OM [29:24] */
++ printk("\t\town_mac = %ld\n", FIELD_GET(MT_TXD1_OWN_MAC, txd->txd_1));
++
++
++ /* TGID [30] */
++ printk("\t\tTGID = %d\n", ((txd->txd_1 & MT_TXD1_TGID) ? 1 : 0));
++
++
++ /* FT [31] */
++ printk("\t\tTxDFormatType = %d\n", (txd->txd_1 & MT_TXD1_LONG_FORMAT) ? 1 : 0);
++
++ printk("\tTMAC_TXD_2:\n");
++ /* DW2 */
++ /* Subtype [3:0] */
++ printk("\t\tsub_type = %ld\n", FIELD_GET(MT_TXD2_SUB_TYPE, txd->txd_2));
++
++ /* Type[5:4] */
++ printk("\t\tfrm_type = %ld\n", FIELD_GET(MT_TXD2_FRAME_TYPE, txd->txd_2));
++
++ /* NDP [6] */
++ printk("\t\tNDP = %d\n", ((txd->txd_2 & MT_TXD2_NDP) ? 1 : 0));
++
++ /* NDPA [7] */
++ printk("\t\tNDPA = %d\n", ((txd->txd_2 & MT_TXD2_NDPA) ? 1 : 0));
++
++ /* SD [8] */
++ printk("\t\tSounding = %d\n", ((txd->txd_2 & MT_TXD2_SOUNDING) ? 1 : 0));
++
++ /* RTS [9] */
++ printk("\t\tRTS = %d\n", ((txd->txd_2 & MT_TXD2_RTS) ? 1 : 0));
++
++ /* BM [10] */
++ printk("\t\tbc_mc_pkt = %d\n", ((txd->txd_2 & MT_TXD2_MULTICAST) ? 1 : 0));
++
++ /* B [11] */
++ printk("\t\tBIP = %d\n", ((txd->txd_2 & MT_TXD2_BIP) ? 1 : 0));
++
++ /* DU [12] */
++ printk("\t\tDuration = %d\n", ((txd->txd_2 & MT_TXD2_DURATION) ? 1 : 0));
++
++ /* HE [13] */
++ printk("\t\tHE(HTC Exist) = %d\n", ((txd->txd_2 & MT_TXD2_HTC_VLD) ? 1 : 0));
++
++ /* FRAG [15:14] */
++ printk("\t\tFRAG = %ld\n", FIELD_GET(MT_TXD2_FRAG, txd->txd_2));
++
++
++ /* Remaining Life Time [23:16]*/
++ printk("\t\tReamingLife/MaxTx time = %ld (unit: 64TU)\n",
++ FIELD_GET(MT_TXD2_MAX_TX_TIME, txd->txd_2));
++
++ /* Power Offset [29:24] */
++ printk("\t\tpwr_offset = %ld\n", FIELD_GET(MT_TXD2_POWER_OFFSET, txd->txd_2));
++
++ /* FRM [30] */
++ printk("\t\tfix rate mode = %d\n", (txd->txd_2 & MT_TXD2_FIXED_RATE) ? 1 : 0);
++
++ /* FR[31] */
++ printk("\t\tfix rate = %d\n", (txd->txd_2 & MT_TXD2_FIX_RATE) ? 1 : 0);
++
++
++ printk("\tTMAC_TXD_3:\n");
++
++ /* DW3 */
++ /* NA [0] */
++ printk("\t\tNoAck = %d\n", (txd->txd_3 & MT_TXD3_NO_ACK) ? 1 : 0);
++
++ /* PF [1] */
++ printk("\t\tPF = %d\n", (txd->txd_3 & MT_TXD3_PROTECT_FRAME) ? 1 : 0);
++
++ /* EMRD [2] */
++ printk("\t\tEMRD = %d\n", (txd->txd_3 & MT_TXD3_EMRD) ? 1 : 0);
++
++ /* EEOSP [3] */
++ printk("\t\tEEOSP = %d\n", (txd->txd_3 & MT_TXD3_EEOSP) ? 1 : 0);
++
++ /* DAS [4] */
++ printk("\t\tda_select = %d\n", (txd->txd_3 & MT_TXD3_DAS) ? 1 : 0);
++
++ /* TM [5] */
++ printk("\t\ttm = %d\n", (txd->txd_3 & MT_TXD3_TIMING_MEASURE) ? 1 : 0);
++
++ /* TX Count [10:6] */
++ printk("\t\ttx_cnt = %ld\n", FIELD_GET(MT_TXD3_TX_COUNT, txd->txd_3));
++
++ /* Remaining TX Count [15:11] */
++ printk("\t\tremain_tx_cnt = %ld\n", FIELD_GET(MT_TXD3_REM_TX_COUNT, txd->txd_3));
++
++ /* SN [27:16] */
++ printk("\t\tsn = %ld\n", FIELD_GET(MT_TXD3_SEQ, txd->txd_3));
++
++ /* BA_DIS [28] */
++ printk("\t\tba dis = %d\n", (txd->txd_3 & MT_TXD3_BA_DISABLE) ? 1 : 0);
++
++ /* Power Management [29] */
++ printk("\t\tpwr_mgmt = 0x%x\n", (txd->txd_3 & MT_TXD3_SW_POWER_MGMT) ? 1 : 0);
++
++ /* PN_VLD [30] */
++ printk("\t\tpn_vld = %d\n", (txd->txd_3 & MT_TXD3_PN_VALID) ? 1 : 0);
++
++ /* SN_VLD [31] */
++ printk("\t\tsn_vld = %d\n", (txd->txd_3 & MT_TXD3_SN_VALID) ? 1 : 0);
++
++
++ /* DW4 */
++ printk("\tTMAC_TXD_4:\n");
++
++ /* PN_LOW [31:0] */
++ printk("\t\tpn_low = 0x%lx\n", FIELD_GET(MT_TXD4_PN_LOW, txd->txd_4));
++
++
++ /* DW5 */
++ printk("\tTMAC_TXD_5:\n");
++
++ /* PID [7:0] */
++ printk("\t\tpid = %ld\n", FIELD_GET(MT_TXD5_PID, txd->txd_5));
++
++ /* TXSFM [8] */
++ printk("\t\ttx_status_fmt = %d\n", (txd->txd_5 & MT_TXD5_TX_STATUS_FMT) ? 1 : 0);
++
++ /* TXS2M [9] */
++ printk("\t\ttx_status_2_mcu = %d\n", (txd->txd_5 & MT_TXD5_TX_STATUS_MCU) ? 1 : 0);
++
++ /* TXS2H [10] */
++ printk("\t\ttx_status_2_host = %d\n", (txd->txd_5 & MT_TXD5_TX_STATUS_HOST) ? 1 : 0);
++
++ /* ADD_BA [14] */
++ printk("\t\tADD_BA = %d\n", (txd->txd_5 & MT_TXD5_ADD_BA) ? 1 : 0);
++
++ /* MD [15] */
++ printk("\t\tMD = %d\n", (txd->txd_5 & MT_TXD5_MD) ? 1 : 0);
++
++ /* PN_HIGH [31:16] */
++ printk("\t\tpn_high = 0x%lx\n", FIELD_GET(MT_TXD5_PN_HIGH, txd->txd_5));
++
++ /* DW6 */
++ printk("\tTMAC_TXD_6:\n");
++
++ if (txd->txd_2 & MT_TXD2_FIX_RATE) {
++ /* Fixed BandWidth mode [2:0] */
++ printk("\t\tbw = %ld\n", FIELD_GET(MT_TXD6_BW, txd->txd_6));
++
++ /* DYN_BW [3] */
++ printk("\t\tdyn_bw = %d\n", (txd->txd_6 & MT_TXD6_DYN_BW) ? 1 : 0);
++
++ /* ANT_ID [7:4] */
++ printk("\t\tant_id = %ld\n", FIELD_GET(MT_TXD6_ANT_ID, txd->txd_6));
++
++ /* SPE_IDX_SEL [10] */
++ printk("\t\tspe_idx_sel = %d\n", (txd->txd_6 & MT_TXD6_SPE_ID_IDX) ? 1 : 0);
++
++ /* LDPC [11] */
++ printk("\t\tldpc = %d\n", (txd->txd_6 & MT_TXD6_LDPC) ? 1 : 0);
++
++ /* HELTF Type[13:12] */
++ printk("\t\tHELTF Type = %ld\n", FIELD_GET(MT_TXD6_HELTF, txd->txd_6));
++
++ /* GI Type [15:14] */
++ printk("\t\tGI = %ld\n", FIELD_GET(MT_TXD6_SGI, txd->txd_6));
++
++ /* Rate to be Fixed [29:16] */
++ printk("\t\ttx_rate = 0x%lx\n", FIELD_GET(MT_TXD6_TX_RATE, txd->txd_6));
++ }
++
++ /* TXEBF [30] */
++ printk("\t\ttxebf = %d\n", (txd->txd_6 & MT_TXD6_TX_EBF) ? 1 : 0);
++
++ /* TXIBF [31] */
++ printk("\t\ttxibf = %d\n", (txd->txd_6 & MT_TXD6_TX_IBF) ? 1 : 0);
++
++ /* DW7 */
++ printk("\tTMAC_TXD_7:\n");
++
++ if ((txd->txd_1 & MT_TXD1_VTA) == 0) {
++ /* SW Tx Time [9:0] */
++ printk("\t\tsw_tx_time = %ld\n", FIELD_GET(MT_TXD7_TX_TIME, txd->txd_7));
++ } else {
++ /* TXD Arrival Time [9:0] */
++ printk("\t\tat = %ld\n", FIELD_GET(MT_TXD7_TAT, txd->txd_7));
++ }
++
++ /* HW_AMSDU_CAP [10] */
++ printk("\t\thw amsdu cap = %d\n",(txd->txd_7 & MT_TXD7_HW_AMSDU) ? 1 : 0);
++
++ /* SPE_IDX [15:11] */
++ if (txd->txd_2 & MT_TXD2_FIX_RATE) {
++ printk("\t\tspe_idx = 0x%lx\n", FIELD_GET(MT_TXD7_SPE_IDX, txd->txd_7));
++ }
++
++ /* PSE_FID [27:16] */
++ printk("\t\tpse_fid = 0x%lx\n", FIELD_GET(MT_TXD7_PSE_FID, txd->txd_7));
++
++ /* Subtype [19:16] */
++ printk("\t\tpp_sub_type=%ld\n", FIELD_GET(MT_TXD7_SUB_TYPE, txd->txd_7));
++
++ /* Type [21:20] */
++ printk("\t\tpp_type=%ld\n", FIELD_GET(MT_TXD7_TYPE, txd->txd_7));
++
++ /* CTXD_CNT [25:23] */
++ printk("\t\tctxd cnt=0x%lx\n", FIELD_GET(MT_TXD7_CTXD_CNT, txd->txd_7));
++
++ /* CTXD [26] */
++ printk("\t\tctxd = %d\n", (txd->txd_7 & MT_TXD7_CTXD) ? 1 : 0);
++
++ /* I [28] */
++ printk("\t\ti = %d\n", (txd->txd_7 & MT_TXD7_IP_SUM) ? 1 : 0);
++
++ /* UT [29] */
++ printk("\t\tUT = %d\n", (txd->txd_7 & MT_TXD7_UDP_TCP_SUM) ? 1 : 0);
++
++ /* TXDLEN [31:30] */
++ printk("\t\t txd len= %ld\n", FIELD_GET(MT_TXD7_TXD_LEN, txd->txd_7));
++}
++
++
++static int mt7915_token_txd_read(struct seq_file *s, void *data)
++{
++ struct mt7915_dev *dev = dev_get_drvdata(s->private);
++ struct mt76_txwi_cache *t;
++ u8* txwi;
++
++ seq_printf(s, "\n");
++ spin_lock_bh(&dev->mt76.token_lock);
++
++ t = idr_find(&dev->mt76.token, dev->dbg.token_idx);
++
++ spin_unlock_bh(&dev->mt76.token_lock);
++ if (t != NULL) {
++ struct mt76_dev *mdev = &dev->mt76;
++ txwi = ((u8*)(t)) - (mdev->drv->txwi_size);
++ mt7915_dump_tmac_info((u8*) txwi);
++ seq_printf(s, "\n");
++ printk("[SKB]\n");
++ print_hex_dump(KERN_ERR , "", DUMP_PREFIX_OFFSET, 16, 1, (u8 *)t->skb->data, t->skb->len, false);
++ seq_printf(s, "\n");
++ }
++ return 0;
++}
++
++static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
++{
++ struct mt7915_dev *dev = dev_get_drvdata(s->private);
++ u32 ple_stat[8] = {0}, total_amsdu = 0;
++ u8 i;
++
++ for (i = 0; i < 8; i++)
++ ple_stat[i] = mt76_rr(dev, MT_DBG_PLE_AMSDU_PACK_MSDU_CNT(i));
++
++ seq_printf(s, "TXD counter status of MSDU:\n");
++
++ for (i = 0; i < 8; i++)
++ total_amsdu += ple_stat[i];
++
++ for (i = 0; i < 8; i++) {
++ seq_printf(s, "AMSDU pack count of %d MSDU in TXD: 0x%x ", i + 1, ple_stat[i]);
++ if (total_amsdu != 0)
++ seq_printf(s, "(%d%%)\n", ple_stat[i] * 100 / total_amsdu);
++ else
++ seq_printf(s, "\n");
++ }
++
++ return 0;
++
++}
++
++static int mt7915_agginfo_read_per_band(struct seq_file *s, int band_idx)
++{
++ struct mt7915_dev *dev = dev_get_drvdata(s->private);
++ u32 value, idx, agg_rang_sel[15], ampdu_cnt[11], total_ampdu = 0;
++
++ seq_printf(s, "Band %d AGG Status\n", band_idx);
++ seq_printf(s, "===============================\n");
++ value = mt76_rr(dev, MT_DBG_AGG_AALCR0(band_idx));
++ seq_printf(s, "AC00 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK, value));
++ seq_printf(s, "AC01 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK, value));
++ seq_printf(s, "AC02 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK, value));
++ seq_printf(s, "AC03 Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK, value));
++
++ value = mt76_rr(dev, MT_DBG_AGG_AALCR1(band_idx));
++ seq_printf(s, "AC10 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK, value));
++ seq_printf(s, "AC11 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK, value));
++ seq_printf(s, "AC12 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK, value));
++ seq_printf(s, "AC13 Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK, value));
++
++ value = mt76_rr(dev, MT_DBG_AGG_AALCR2(band_idx));
++ seq_printf(s, "AC20 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK, value));
++ seq_printf(s, "AC21 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK, value));
++ seq_printf(s, "AC22 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK, value));
++ seq_printf(s, "AC23 Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK, value));
++
++ value = mt76_rr(dev, MT_DBG_AGG_AALCR3(band_idx));
++ seq_printf(s, "AC30 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK, value));
++ seq_printf(s, "AC31 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK, value));
++ seq_printf(s, "AC32 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK, value));
++ seq_printf(s, "AC33 Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK, value));
++
++ value = mt76_rr(dev, MT_DBG_AGG_AALCR4(band_idx));
++ seq_printf(s, "ALTX Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR4_ALTX0_AGG_LIMIT_MASK, value));
++
++ value = mt76_rr(dev, MT_DBG_AGG_AWSCR(band_idx, 0));
++ seq_printf(s, "Winsize0 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR0_WINSIZE0_MASK, value));
++ seq_printf(s, "Winsize1 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR0_WINSIZE1_MASK, value));
++ seq_printf(s, "Winsize2 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR0_WINSIZE2_MASK, value));
++ seq_printf(s, "Winsize3 limit = %ld\n", FIELD_GET(MT_DBG_AGG_AWSCR0_WINSIZE3_MASK, value));
++
++ value = mt76_rr(dev, MT_DBG_AGG_AWSCR(band_idx, 1));
++ seq_printf(s, "Winsize4 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR1_WINSIZE4_MASK, value));
++ seq_printf(s, "Winsize5 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR1_WINSIZE5_MASK, value));
++ seq_printf(s, "Winsize6 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR1_WINSIZE6_MASK, value));
++ seq_printf(s, "Winsize7 limit = %ld\n", FIELD_GET(MT_DBG_AGG_AWSCR1_WINSIZE7_MASK, value));
++
++ value = mt76_rr(dev, MT_DBG_AGG_AWSCR(band_idx, 2));
++ seq_printf(s, "Winsize8 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR2_WINSIZE8_MASK, value));
++ seq_printf(s, "Winsize9 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR2_WINSIZE9_MASK, value));
++ seq_printf(s, "WinsizeA limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR2_WINSIZEA_MASK, value));
++ seq_printf(s, "WinsizeB limit = %ld\n", FIELD_GET(MT_DBG_AGG_AWSCR2_WINSIZEB_MASK, value));
++
++
++ value = mt76_rr(dev, MT_DBG_AGG_AWSCR(band_idx, 3));
++ seq_printf(s, "WinsizeC limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR3_WINSIZEC_MASK, value));
++ seq_printf(s, "WinsizeD limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR3_WINSIZED_MASK, value));
++ seq_printf(s, "WinsizeE limit = %ld\n", FIELD_GET(MT_DBG_AGG_AWSCR3_WINSIZEE_MASK, value));
++
++ seq_printf(s, "===AMPDU Related Counters===\n");
++
++ value = mt76_rr(dev, MT_DBG_MIB_M0ARNG(band_idx, 0));
++ agg_rang_sel[0] = FIELD_GET(MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL0_MASK, value);
++ agg_rang_sel[1] = FIELD_GET(MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL1_MASK, value);
++ agg_rang_sel[2] = FIELD_GET(MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL2_MASK, value);
++ agg_rang_sel[3] = FIELD_GET(MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL3_MASK, value);
++
++ value = mt76_rr(dev, MT_DBG_MIB_M0ARNG(band_idx, 1));
++ agg_rang_sel[4] = FIELD_GET(MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL4_MASK, value);
++ agg_rang_sel[5] = FIELD_GET(MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL5_MASK, value);
++ agg_rang_sel[6] = FIELD_GET(MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL6_MASK, value);
++ agg_rang_sel[7] = FIELD_GET(MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL7_MASK, value);
++
++ value = mt76_rr(dev, MT_DBG_MIB_M0ARNG(band_idx, 2));
++ agg_rang_sel[8] = FIELD_GET(MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL8_MASK, value);
++ agg_rang_sel[9] = FIELD_GET(MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL9_MASK, value);
++ agg_rang_sel[10] = FIELD_GET(MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL10_MASK, value);
++ agg_rang_sel[11] = FIELD_GET(MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL11_MASK, value);
++
++ value = mt76_rr(dev, MT_DBG_MIB_M0ARNG(band_idx, 3));
++ agg_rang_sel[12] = FIELD_GET(MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL12_MASK, value);
++ agg_rang_sel[13] = FIELD_GET(MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL13_MASK, value);
++ agg_rang_sel[14] = FIELD_GET(MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL14_MASK, value);
++
++ /* Need to add 1 after read from AGG_RANG_SEL CR */
++ for (idx = 0; idx < 15; idx++)
++ agg_rang_sel[idx]++;
++
++ ampdu_cnt[3] = mt76_rr(dev, MT_DBG_MIB_M0DR2(band_idx, 0));
++ ampdu_cnt[4] = mt76_rr(dev, MT_DBG_MIB_M0DR2(band_idx, 1));
++ ampdu_cnt[5] = mt76_rr(dev, MT_DBG_MIB_M0DR2(band_idx, 2));
++ ampdu_cnt[6] = mt76_rr(dev, MT_DBG_MIB_M0DR2(band_idx, 3));
++ ampdu_cnt[7] = mt76_rr(dev, MT_DBG_MIB_M0DR13(band_idx, 0));
++ ampdu_cnt[8] = mt76_rr(dev, MT_DBG_MIB_M0DR13(band_idx, 1));
++ ampdu_cnt[9] = mt76_rr(dev, MT_DBG_MIB_M0DR13(band_idx, 2));
++ ampdu_cnt[10] = mt76_rr(dev, MT_DBG_MIB_M0DR13(band_idx, 3));
++
++ seq_printf(s, "\tTx Agg Range: \t%d \t%d~%d \t%d~%d \t%d~%d \t%d~%d \t%d~%d \t%d~%d \t%d~%d\n",
++ agg_rang_sel[0],
++ agg_rang_sel[0] + 1, agg_rang_sel[1],
++ agg_rang_sel[1] + 1, agg_rang_sel[2],
++ agg_rang_sel[2] + 1, agg_rang_sel[3],
++ agg_rang_sel[3] + 1, agg_rang_sel[4],
++ agg_rang_sel[4] + 1, agg_rang_sel[5],
++ agg_rang_sel[5] + 1, agg_rang_sel[6],
++ agg_rang_sel[6] + 1, agg_rang_sel[7]);
++
++#define BIT_0_to_15_MASK 0x0000FFFF
++#define BIT_15_to_31_MASK 0xFFFF0000
++#define SHFIT_16_BIT 16
++
++ for (idx = 3; idx < 11; idx++)
++ total_ampdu = total_ampdu + (ampdu_cnt[idx] & BIT_0_to_15_MASK) + ((ampdu_cnt[idx] & BIT_15_to_31_MASK) >> SHFIT_16_BIT);
++
++ seq_printf(s, "\t\t\t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx\n",
++ (ampdu_cnt[3]) & MT_DBG_MIB_M0DR2_TRX_AGG_RANGE0_CNT_MASK,
++ FIELD_GET(MT_DBG_MIB_M0DR2_TRX_AGG_RANGE1_CNT_MASK, ampdu_cnt[3]),
++ (ampdu_cnt[4]) & MT_DBG_MIB_M0DR3_TRX_AGG_RANGE2_CNT_MASK,
++ FIELD_GET(MT_DBG_MIB_M0DR3_TRX_AGG_RANGE3_CNT_MASK, ampdu_cnt[4]),
++ (ampdu_cnt[5]) & MT_DBG_MIB_M0DR4_TRX_AGG_RANGE4_CNT_MASK,
++ FIELD_GET(MT_DBG_MIB_M0DR4_TRX_AGG_RANGE5_CNT_MASK, ampdu_cnt[5]),
++ (ampdu_cnt[6]) & MT_DBG_MIB_M0DR5_TRX_AGG_RANGE6_CNT_MASK,
++ FIELD_GET(MT_DBG_MIB_M0DR5_TRX_AGG_RANGE7_CNT_MASK, ampdu_cnt[6]));
++
++ if (total_ampdu != 0) {
++ seq_printf(s, "\t\t\t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%)\n",
++ ((ampdu_cnt[3]) & MT_DBG_MIB_M0DR2_TRX_AGG_RANGE0_CNT_MASK) * 100 / total_ampdu,
++ FIELD_GET(MT_DBG_MIB_M0DR2_TRX_AGG_RANGE1_CNT_MASK, ampdu_cnt[3]) * 100 / total_ampdu,
++ ((ampdu_cnt[4]) & MT_DBG_MIB_M0DR3_TRX_AGG_RANGE2_CNT_MASK) * 100 / total_ampdu,
++ FIELD_GET(MT_DBG_MIB_M0DR3_TRX_AGG_RANGE3_CNT_MASK, ampdu_cnt[4]) * 100 / total_ampdu,
++ ((ampdu_cnt[5]) & MT_DBG_MIB_M0DR4_TRX_AGG_RANGE4_CNT_MASK) * 100 / total_ampdu,
++ FIELD_GET(MT_DBG_MIB_M0DR4_TRX_AGG_RANGE5_CNT_MASK, ampdu_cnt[5]) * 100 / total_ampdu,
++ ((ampdu_cnt[6]) & MT_DBG_MIB_M0DR5_TRX_AGG_RANGE6_CNT_MASK) * 100 / total_ampdu,
++ FIELD_GET(MT_DBG_MIB_M0DR5_TRX_AGG_RANGE7_CNT_MASK, ampdu_cnt[6]) * 100 / total_ampdu);
++ }
++
++ seq_printf(s, "\t\t\t%d~%d\t%d~%d\t%d~%d\t%d~%d\t%d~%d\t%d~%d\t%d~%d\t%d~256\n",
++ agg_rang_sel[7] + 1, agg_rang_sel[8],
++ agg_rang_sel[8] + 1, agg_rang_sel[9],
++ agg_rang_sel[9] + 1, agg_rang_sel[10],
++ agg_rang_sel[10] + 1, agg_rang_sel[11],
++ agg_rang_sel[11] + 1, agg_rang_sel[12],
++ agg_rang_sel[12] + 1, agg_rang_sel[13],
++ agg_rang_sel[13] + 1, agg_rang_sel[14],
++ agg_rang_sel[14] + 1);
++
++ seq_printf(s, "\t\t\t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx\n",
++ (ampdu_cnt[7]) & MT_DBG_MIB_M0DR13_TRX_AGG_RANGE8_CNT_MASK,
++ FIELD_GET(MT_DBG_MIB_M0DR13_TRX_AGG_RANGE9_CNT_MASK, ampdu_cnt[7]),
++ (ampdu_cnt[8]) & MT_DBG_MIB_M0DR14_TRX_AGG_RANGE10_CNT_MASK,
++ FIELD_GET(MT_DBG_MIB_M0DR14_TRX_AGG_RANGE11_CNT_MASK, ampdu_cnt[8]),
++ (ampdu_cnt[9]) & MT_DBG_MIB_M0DR15_TRX_AGG_RANGE12_CNT_MASK,
++ FIELD_GET(MT_DBG_MIB_M0DR15_TRX_AGG_RANGE13_CNT_MASK, ampdu_cnt[9]),
++ (ampdu_cnt[10]) & MT_DBG_MIB_M0DR16_TRX_AGG_RANGE14_CNT_MASK,
++ FIELD_GET(MT_DBG_MIB_M0DR16_TRX_AGG_RANGE15_CNT_MASK, ampdu_cnt[10]));
++
++ if (total_ampdu != 0) {
++ seq_printf(s, "\t\t\t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%)\n",
++ ((ampdu_cnt[7]) & MT_DBG_MIB_M0DR2_TRX_AGG_RANGE0_CNT_MASK) * 100 / total_ampdu,
++ FIELD_GET(MT_DBG_MIB_M0DR2_TRX_AGG_RANGE1_CNT_MASK, ampdu_cnt[7]) * 100 / total_ampdu,
++ ((ampdu_cnt[8]) & MT_DBG_MIB_M0DR3_TRX_AGG_RANGE2_CNT_MASK) * 100 / total_ampdu,
++ FIELD_GET(MT_DBG_MIB_M0DR3_TRX_AGG_RANGE3_CNT_MASK, ampdu_cnt[8]) * 100 / total_ampdu,
++ ((ampdu_cnt[9]) & MT_DBG_MIB_M0DR4_TRX_AGG_RANGE4_CNT_MASK) * 100 / total_ampdu,
++ FIELD_GET(MT_DBG_MIB_M0DR4_TRX_AGG_RANGE5_CNT_MASK, ampdu_cnt[9]) * 100 / total_ampdu,
++ ((ampdu_cnt[10]) & MT_DBG_MIB_M0DR5_TRX_AGG_RANGE6_CNT_MASK) * 100 / total_ampdu,
++ FIELD_GET(MT_DBG_MIB_M0DR5_TRX_AGG_RANGE7_CNT_MASK, ampdu_cnt[10]) * 100 / total_ampdu);
++ }
++
++ return 0;
++}
++
++static int mt7915_agginfo_read_band0(struct seq_file *s, void *data)
++{
++ mt7915_agginfo_read_per_band(s, 0);
++ return 0;
++}
++
++static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
++{
++ mt7915_agginfo_read_per_band(s, 1);
++ return 0;
++}
++
++/*usage: <en> <num> <len>
++ en: BIT(16) 0: sw amsdu 1: hw amsdu
++ num: GENMASK(15, 8) range 1-8
++ len: GENMASK(7, 0) unit: 256 bytes */
++static int mt7915_sta_tx_amsdu_set(void *data, u64 tx_amsdu)
++{
++/* UWTBL DW 6 */
++#define WTBL_AMSDU_LEN_MASK GENMASK(5, 0)
++#define WTBL_AMSDU_NUM_MASK GENMASK(8, 6)
++#define WTBL_AMSDU_EN_MASK BIT(9)
++#define UWTBL_HW_AMSDU_DW 6
++
++ struct mt7915_dev *dev = data;
++ u32 len = FIELD_GET(GENMASK(7, 0), tx_amsdu);
++ u32 num = FIELD_GET(GENMASK(15, 8), tx_amsdu);
++ u32 uwtbl;
++
++ mt7915_mcu_set_amsdu_algo(dev, dev->wlan_idx, 0);
++
++ mt7915_wtbl_read_raw(dev, dev->wlan_idx, WTBL_TYPE_UMAC,
++ UWTBL_HW_AMSDU_DW, 1, &uwtbl);
++
++ if (len) {
++ uwtbl &= ~WTBL_AMSDU_LEN_MASK;
++ uwtbl |= FIELD_PREP(WTBL_AMSDU_LEN_MASK, len);
++ }
++
++ uwtbl &= ~WTBL_AMSDU_NUM_MASK;
++ uwtbl |= FIELD_PREP(WTBL_AMSDU_NUM_MASK, num);
++
++ if (tx_amsdu & BIT(16))
++ uwtbl |= WTBL_AMSDU_EN_MASK;
++
++ mt7915_wtbl_write_raw(dev, dev->wlan_idx, WTBL_TYPE_UMAC,
++ UWTBL_HW_AMSDU_DW, uwtbl);
++
++ return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_tx_amsdu, NULL,
++ mt7915_sta_tx_amsdu_set, "%llx\n");
++
++static int mt7915_red_enable_set(void *data, u64 en)
++{
++ struct mt7915_dev *dev = data;
++
++ return mt7915_mcu_set_red(dev, en);
++}
++DEFINE_DEBUGFS_ATTRIBUTE(fops_red_en, NULL,
++ mt7915_red_enable_set, "%llx\n");
++
++static int mt7915_red_show_sta_set(void *data, u64 wlan_idx)
++{
++ struct mt7915_dev *dev = data;
++
++ mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
++ MCU_WA_PARAM_RED_SHOW_STA,
++ wlan_idx, 0, true);
++
++ return 0;
++}
++DEFINE_DEBUGFS_ATTRIBUTE(fops_red_show_sta, NULL,
++ mt7915_red_show_sta_set, "%llx\n");
++
++static int mt7915_red_target_dly_set(void *data, u64 delay)
++{
++ struct mt7915_dev *dev = data;
++
++ if (delay > 0 && delay <= 32767)
++ mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
++ MCU_WA_PARAM_RED_TARGET_DELAY,
++ delay, 0, true);
++
++ return 0;
++}
++DEFINE_DEBUGFS_ATTRIBUTE(fops_red_target_dly, NULL,
++ mt7915_red_target_dly_set, "%llx\n");
++
++static int
++mt7915_txpower_level_set(void *data, u64 val)
++{
++ struct mt7915_dev *dev = data;
++ struct mt7915_phy *ext_phy = mt7915_ext_phy(dev);
++ mt7915_mcu_set_txpower_level(&dev->phy, val);
++ if (ext_phy)
++ mt7915_mcu_set_txpower_level(ext_phy, val);
++
++ return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_txpower_level, NULL,
++ mt7915_txpower_level_set, "%lld\n");
++
++/* usage: echo 0x[arg3][arg2][arg1] > fw_wa_set */
++static int
++mt7915_wa_set(void *data, u64 val)
++{
++ struct mt7915_dev *dev = data;
++ u32 arg1, arg2, arg3;
++
++ arg1 = FIELD_GET(GENMASK_ULL(7, 0), val);
++ arg2 = FIELD_GET(GENMASK_ULL(15, 8), val);
++ arg3 = FIELD_GET(GENMASK_ULL(23, 16), val);
++
++ mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET), arg1, arg2, arg3, false);
++
++ return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_set, NULL, mt7915_wa_set,
++ "0x%llx\n");
++/* usage: echo 0x[arg3][arg2][arg1] > fw_wa_query */
++static int
++mt7915_wa_query(void *data, u64 val)
++{
++ struct mt7915_dev *dev = data;
++ u32 arg1, arg2, arg3;
++
++ arg1 = FIELD_GET(GENMASK_ULL(7, 0), val);
++ arg2 = FIELD_GET(GENMASK_ULL(15, 8), val);
++ arg3 = FIELD_GET(GENMASK_ULL(23, 16), val);
++
++ mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(QUERY), arg1, arg2, arg3, false);
++
++ return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_query, NULL, mt7915_wa_query,
++ "0x%llx\n");
++/* set wa debug level
++ usage:
++ echo 0x[arg] > fw_wa_debug
++ bit0 : DEBUG_WIFI_TX
++ bit1 : DEBUG_CMD_EVENT
++ bit2 : DEBUG_RED
++ bit3 : DEBUG_WARN
++ bit4 : DEBUG_WIFI_RX
++ bit5 : DEBUG_TIME_STAMP
++ bit6 : DEBUG_TX_FREE_DONE_EVENT
++ bit12 : DEBUG_WIFI_TXD */
++static int
++mt7915_wa_debug(void *data, u64 val)
++{
++ struct mt7915_dev *dev = data;
++ u32 arg;
++
++ arg = FIELD_GET(GENMASK_ULL(15, 0), val);
++
++ mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(DEBUG), arg, 0, 0, false);
++
++ return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_debug, NULL, mt7915_wa_debug,
++ "0x%llx\n");
++
++int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
++{
++ struct mt7915_dev *dev = phy->dev;
++ u32 device_id = (dev->mt76.rev) >> 16;
++ int i = 0;
++
++ for (i = 0; i < ARRAY_SIZE(dbg_reg_s); i++) {
++ if (device_id == dbg_reg_s[i].id) {
++ dev->dbg_reg = &dbg_reg_s[i];
++ break;
++ }
++ }
++
++ mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
++
++ debugfs_create_file("fw_debug_module", 0600, dir, dev,
++ &fops_fw_debug_module);
++ debugfs_create_file("fw_debug_level", 0600, dir, dev,
++ &fops_fw_debug_level);
++
++ debugfs_create_devm_seqfile(dev->mt76.dev, "sta_info", dir,
++ mt7915_sta_info);
++ debugfs_create_devm_seqfile(dev->mt76.dev, "wtbl_info", dir,
++ mt7915_wtbl_read);
++ debugfs_create_devm_seqfile(dev->mt76.dev, "uwtbl_info", dir,
++ mt7915_uwtbl_read);
++
++ debugfs_create_devm_seqfile(dev->mt76.dev, "tr_info", dir,
++ mt7915_trinfo_read);
++
++ debugfs_create_devm_seqfile(dev->mt76.dev, "drr_info", dir,
++ mt7915_drr_info);
++
++ debugfs_create_devm_seqfile(dev->mt76.dev, "ple_info", dir,
++ mt7915_pleinfo_read);
++
++ debugfs_create_devm_seqfile(dev->mt76.dev, "pse_info", dir,
++ mt7915_pseinfo_read);
++
++ debugfs_create_devm_seqfile(dev->mt76.dev, "mib_info0", dir,
++ mt7915_mibinfo_band0);
++ debugfs_create_devm_seqfile(dev->mt76.dev, "mib_info1", dir,
++ mt7915_mibinfo_band1);
++
++ debugfs_create_u32("token_idx", 0600, dir, &dev->dbg.token_idx);
++ debugfs_create_devm_seqfile(dev->mt76.dev, "token", dir,
++ mt7915_token_read);
++ debugfs_create_devm_seqfile(dev->mt76.dev, "token_txd", dir,
++ mt7915_token_txd_read);
++
++ debugfs_create_devm_seqfile(dev->mt76.dev, "amsdu_info", dir,
++ mt7915_amsduinfo_read);
++
++ debugfs_create_devm_seqfile(dev->mt76.dev, "agg_info0", dir,
++ mt7915_agginfo_read_band0);
++ debugfs_create_devm_seqfile(dev->mt76.dev, "agg_info1", dir,
++ mt7915_agginfo_read_band1);
++
++ debugfs_create_file("tx_amsdu", 0600, dir, dev, &fops_tx_amsdu);
++
++ debugfs_create_file("fw_wa_query", 0600, dir, dev, &fops_wa_query);
++ debugfs_create_file("fw_wa_set", 0600, dir, dev, &fops_wa_set);
++ debugfs_create_file("fw_wa_debug", 0600, dir, dev, &fops_wa_debug);
++
++ debugfs_create_file("red_en", 0600, dir, dev,
++ &fops_red_en);
++ debugfs_create_file("red_show_sta", 0600, dir, dev,
++ &fops_red_show_sta);
++ debugfs_create_file("red_target_dly", 0600, dir, dev,
++ &fops_red_target_dly);
++
++ debugfs_create_file("txpower_level", 0400, dir, dev,
++ &fops_txpower_level);
++
++ debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
++
++ return 0;
++}
++#endif
+diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
+new file mode 100644
+index 00000000..145fe785
+--- /dev/null
++++ b/mt7915/mtk_mcu.c
+@@ -0,0 +1,51 @@
++#include <linux/firmware.h>
++#include <linux/fs.h>
++#include<linux/inet.h>
++#include "mt7915.h"
++#include "mcu.h"
++#include "mac.h"
++
++int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct mt7915_sku_val {
++ u8 format_id;
++ u8 val;
++ u8 band;
++ u8 _rsv;
++ } __packed req = {
++ .format_id = 1,
++ .band = phy->band_idx,
++ .val = !!drop_level,
++ };
++ int ret;
++
++ ret = mt76_mcu_send_msg(&dev->mt76,
++ MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
++ sizeof(req), true);
++ if (ret)
++ return ret;
++
++ req.format_id = 2;
++ if ((drop_level > 90 && drop_level < 100) || !drop_level)
++ req.val = 0;
++ else if (drop_level > 60 && drop_level <= 90)
++ /* reduce Pwr for 1 dB. */
++ req.val = 2;
++ else if (drop_level > 30 && drop_level <= 60)
++ /* reduce Pwr for 3 dB. */
++ req.val = 6;
++ else if (drop_level > 15 && drop_level <= 30)
++ /* reduce Pwr for 6 dB. */
++ req.val = 12;
++ else if (drop_level > 9 && drop_level <= 15)
++ /* reduce Pwr for 9 dB. */
++ req.val = 18;
++ else if (drop_level > 0 && drop_level <= 9)
++ /* reduce Pwr for 12 dB. */
++ req.val = 24;
++
++ return mt76_mcu_send_msg(&dev->mt76,
++ MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
++ sizeof(req), true);
++}
+diff --git a/tools/fwlog.c b/tools/fwlog.c
+index e5d4a105..3d51d9ec 100644
+--- a/tools/fwlog.c
++++ b/tools/fwlog.c
+@@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
+ return path;
+ }
+
+-static int mt76_set_fwlog_en(const char *phyname, bool en)
++static int mt76_set_fwlog_en(const char *phyname, bool en, char *val)
+ {
+ FILE *f = fopen(debugfs_path(phyname, "fw_debug_bin"), "w");
+
+@@ -35,7 +35,13 @@ static int mt76_set_fwlog_en(const char *phyname, bool en)
+ return 1;
+ }
+
+- fprintf(f, "7");
++ if (en && val)
++ fprintf(f, "%s", val);
++ else if (en)
++ fprintf(f, "7");
++ else
++ fprintf(f, "0");
++
+ fclose(f);
+
+ return 0;
+@@ -76,6 +82,7 @@ static void handle_signal(int sig)
+
+ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ {
++#define BUF_SIZE 1504
+ struct sockaddr_in local = {
+ .sin_family = AF_INET,
+ .sin_addr.s_addr = INADDR_ANY,
+@@ -84,9 +91,10 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ .sin_family = AF_INET,
+ .sin_port = htons(55688),
+ };
+- char buf[1504];
++ char *buf = calloc(BUF_SIZE, sizeof(char));
++ FILE *logfile = NULL;
+ int ret = 0;
+- int yes = 1;
++ /* int yes = 1; */
+ int s, fd;
+
+ if (argc < 1) {
+@@ -99,19 +107,28 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ return 1;
+ }
+
++ if (argc == 3) {
++ fprintf(stdout, "start logging to file %s\n", argv[2]);
++ logfile = fopen(argv[2], "wb");
++ if (!logfile) {
++ perror("fopen");
++ return 1;
++ }
++ }
++
+ s = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP);
+ if (s < 0) {
+ perror("socket");
+ return 1;
+ }
+
+- setsockopt(s, SOL_SOCKET, SO_BROADCAST, &yes, sizeof(yes));
++ /* setsockopt(s, SOL_SOCKET, SO_BROADCAST, &yes, sizeof(yes)); */
+ if (bind(s, (struct sockaddr *)&local, sizeof(local)) < 0) {
+ perror("bind");
+ return 1;
+ }
+
+- if (mt76_set_fwlog_en(phyname, true))
++ if (mt76_set_fwlog_en(phyname, true, argv[1]))
+ return 1;
+
+ fd = open(debugfs_path(phyname, "fwlog_data"), O_RDONLY);
+@@ -145,8 +162,8 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ if (!r)
+ continue;
+
+- if (len > sizeof(buf)) {
+- fprintf(stderr, "Length error: %d > %d\n", len, (int)sizeof(buf));
++ if (len > BUF_SIZE) {
++ fprintf(stderr, "Length error: %d > %d\n", len, BUF_SIZE);
+ ret = 1;
+ break;
+ }
+@@ -164,14 +181,19 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ break;
+ }
+
+- /* send buf */
+- sendto(s, buf, len, 0, (struct sockaddr *)&remote, sizeof(remote));
++ if (logfile)
++ fwrite(buf, 1, len, logfile);
++ else
++ /* send buf */
++ sendto(s, buf, len, 0, (struct sockaddr *)&remote, sizeof(remote));
+ }
+
+ close(fd);
+
+ out:
+- mt76_set_fwlog_en(phyname, false);
++ mt76_set_fwlog_en(phyname, false, NULL);
++ free(buf);
++ fclose(logfile);
+
+ return ret;
+ }
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
new file mode 100644
index 0000000..cc9e5ed
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -0,0 +1,918 @@
+From 3913add871ba0d7b4b6a997109ee2acb6d7e5ed3 Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Mon, 6 Jun 2022 20:13:02 +0800
+Subject: [PATCH 1002/1010] mt76: mt7915: csi: implement csi support
+
+---
+ mt76_connac_mcu.h | 2 +
+ mt7915/Makefile | 4 +-
+ mt7915/init.c | 39 ++++
+ mt7915/mcu.c | 111 ++++++++++++
+ mt7915/mcu.h | 76 ++++++++
+ mt7915/mt7915.h | 20 ++
+ mt7915/vendor.c | 452 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h | 60 ++++++
+ 8 files changed, 762 insertions(+), 2 deletions(-)
+ create mode 100644 mt7915/vendor.c
+ create mode 100644 mt7915/vendor.h
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index ff733f9f..3f35c6fb 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -987,6 +987,7 @@ enum {
+ MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
+ MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
+ MCU_EXT_EVENT_MURU_CTRL = 0x9f,
++ MCU_EXT_EVENT_CSI_REPORT = 0xc2,
+ };
+
+ /* unified event table */
+@@ -1180,6 +1181,7 @@ enum {
+ MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
+ MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
+ MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
++ MCU_EXT_CMD_CSI_CTRL = 0xc2,
+ };
+
+ enum {
+diff --git a/mt7915/Makefile b/mt7915/Makefile
+index a42866e9..14ce98a6 100644
+--- a/mt7915/Makefile
++++ b/mt7915/Makefile
+@@ -1,9 +1,9 @@
+ # SPDX-License-Identifier: ISC
+-
++EXTRA_CFLAGS += -DCONFIG_MTK_VENDOR
+ obj-$(CONFIG_MT7915E) += mt7915e.o
+
+ mt7915e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
+- debugfs.o mmio.o mtk_debugfs.o mtk_mcu.o
++ debugfs.o mmio.o mtk_debugfs.o mtk_mcu.o vendor.o
+
+ mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
+ mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
+diff --git a/mt7915/init.c b/mt7915/init.c
+index 9e69ab82..34ace7c9 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -574,6 +574,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+ /* init wiphy according to mphy and phy */
+ mt7915_init_wiphy(mphy->hw);
+
++#ifdef CONFIG_MTK_VENDOR
++ INIT_LIST_HEAD(&phy->csi.csi_list);
++ spin_lock_init(&phy->csi.csi_lock);
++ mt7915_vendor_register(phy);
++#endif
++
+ ret = mt76_register_phy(mphy, true, mt76_rates,
+ ARRAY_SIZE(mt76_rates));
+ if (ret)
+@@ -1079,6 +1085,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+ }
+ }
+
++#ifdef CONFIG_MTK_VENDOR
++static int mt7915_unregister_features(struct mt7915_phy *phy)
++{
++ struct csi_data *c, *tmp_c;
++
++ spin_lock_bh(&phy->csi.csi_lock);
++ phy->csi.enable = 0;
++
++ list_for_each_entry_safe(c, tmp_c, &phy->csi.csi_list, node) {
++ list_del(&c->node);
++ kfree(c);
++ }
++ spin_unlock_bh(&phy->csi.csi_lock);
++
++
++ return 0;
++}
++#endif
++
+ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+ {
+ struct mt7915_phy *phy = mt7915_ext_phy(dev);
+@@ -1087,6 +1112,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+ if (!phy)
+ return;
+
++#ifdef CONFIG_MTK_VENDOR
++ mt7915_unregister_features(phy);
++#endif
++
+ mt7915_unregister_thermal(phy);
+ mt76_unregister_phy(mphy);
+ ieee80211_free_hw(mphy->hw);
+@@ -1099,6 +1128,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+ mt7915_dma_cleanup(dev);
+ tasklet_disable(&dev->irq_tasklet);
+
++#ifdef CONFIG_MTK_VENDOR
++ mt7915_unregister_features(&dev->phy);
++#endif
++
+ if (is_mt7986(&dev->mt76))
+ mt7986_wmac_disable(dev);
+ }
+@@ -1141,6 +1174,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+ dev->mt76.test_ops = &mt7915_testmode_ops;
+ #endif
+
++#ifdef CONFIG_MTK_VENDOR
++ INIT_LIST_HEAD(&dev->phy.csi.csi_list);
++ spin_lock_init(&dev->phy.csi.csi_lock);
++ mt7915_vendor_register(&dev->phy);
++#endif
++
+ /* init led callbacks */
+ if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+ dev->mt76.led_cdev.brightness_set = mt7915_led_set_brightness;
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 5af6de5d..e6cd1e2c 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -36,6 +36,10 @@ static bool sr_scene_detect = true;
+ module_param(sr_scene_detect, bool, 0644);
+ MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
+
++#ifdef CONFIG_MTK_VENDOR
++static int mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb);
++#endif
++
+ static u8
+ mt7915_mcu_get_sta_nss(u16 mcs_map)
+ {
+@@ -355,6 +359,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ case MCU_EXT_EVENT_FW_LOG_2_HOST:
+ mt7915_mcu_rx_log_message(dev, skb);
+ break;
++#ifdef CONFIG_MTK_VENDOR
++ case MCU_EXT_EVENT_CSI_REPORT:
++ mt7915_mcu_report_csi(dev, skb);
++ break;
++#endif
+ case MCU_EXT_EVENT_BCC_NOTIFY:
+ mt7915_mcu_rx_bcc_notify(dev, skb);
+ break;
+@@ -3751,6 +3760,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+ &req, sizeof(req), true);
+ }
+
++#ifdef CONFIG_MTK_VENDOR
++int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
++ u8 cfg, u8 v1, u32 v2, u8 *mac_addr)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct mt7915_mcu_csi req = {
++ .band = phy != &dev->phy,
++ .mode = mode,
++ .cfg = cfg,
++ .v1 = v1,
++ .v2 = cpu_to_le32(v2),
++ };
++
++ if (is_valid_ether_addr(mac_addr))
++ ether_addr_copy(req.mac_addr, mac_addr);
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CSI_CTRL), &req,
++ sizeof(req), false);
++}
++
++static int
++mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
++{
++ struct mt76_connac2_mcu_rxd *rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
++ struct mt7915_phy *phy = &dev->phy;
++ struct mt7915_mcu_csi_report *cr;
++ struct csi_data *csi;
++ int len, i;
++
++ skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
++
++ len = le16_to_cpu(rxd->len) - sizeof(struct mt76_connac2_mcu_rxd) + 24;
++ if (len < sizeof(*cr))
++ return -EINVAL;
++
++ cr = (struct mt7915_mcu_csi_report *)skb->data;
++
++ if (phy->csi.interval &&
++ le32_to_cpu(cr->ts) < phy->csi.last_record + phy->csi.interval)
++ return 0;
++
++ csi = kzalloc(sizeof(*csi), GFP_KERNEL);
++ if (!csi)
++ return -ENOMEM;
++
++#define SET_CSI_DATA(_field) csi->_field = le32_to_cpu(cr->_field)
++ SET_CSI_DATA(ch_bw);
++ SET_CSI_DATA(rssi);
++ SET_CSI_DATA(snr);
++ SET_CSI_DATA(data_num);
++ SET_CSI_DATA(data_bw);
++ SET_CSI_DATA(pri_ch_idx);
++ SET_CSI_DATA(info);
++ SET_CSI_DATA(rx_mode);
++ SET_CSI_DATA(h_idx);
++ SET_CSI_DATA(ts);
++
++ SET_CSI_DATA(band);
++ if (csi->band && !phy->band_idx)
++ phy = mt7915_ext_phy(dev);
++#undef SET_CSI_DATA
++
++ for (i = 0; i < csi->data_num; i++) {
++ csi->data_i[i] = le16_to_cpu(cr->data_i[i]);
++ csi->data_q[i] = le16_to_cpu(cr->data_q[i]);
++ }
++
++ memcpy(csi->ta, cr->ta, ETH_ALEN);
++ csi->tx_idx = le32_get_bits(cr->trx_idx, GENMASK(31, 16));
++ csi->rx_idx = le32_get_bits(cr->trx_idx, GENMASK(15, 0));
++
++ INIT_LIST_HEAD(&csi->node);
++ spin_lock_bh(&phy->csi.csi_lock);
++
++ if (!phy->csi.enable) {
++ kfree(csi);
++ spin_unlock_bh(&phy->csi.csi_lock);
++ return 0;
++ }
++
++ list_add_tail(&csi->node, &phy->csi.csi_list);
++ phy->csi.count++;
++
++ if (phy->csi.count > CSI_MAX_BUF_NUM) {
++ struct csi_data *old;
++
++ old = list_first_entry(&phy->csi.csi_list,
++ struct csi_data, node);
++
++ list_del(&old->node);
++ kfree(old);
++ phy->csi.count--;
++ }
++
++ if (csi->h_idx & BIT(15)) /* last chain */
++ phy->csi.last_record = csi->ts;
++ spin_unlock_bh(&phy->csi.csi_lock);
++
++ return 0;
++}
++#endif
++
+ #ifdef MTK_DEBUG
+ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
+ {
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index b7e8ba2e..50bf4cb6 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -513,4 +513,80 @@ enum {
+ sizeof(struct bss_info_bcn_cont) + \
+ sizeof(struct bss_info_inband_discovery))
+
++#ifdef CONFIG_MTK_VENDOR
++struct mt7915_mcu_csi {
++ u8 band;
++ u8 mode;
++ u8 cfg;
++ u8 v1;
++ __le32 v2;
++ u8 mac_addr[ETH_ALEN];
++ u8 _rsv[34];
++} __packed;
++
++struct csi_tlv {
++ __le32 tag;
++ __le32 len;
++} __packed;
++
++#define CSI_MAX_COUNT 256
++#define CSI_MAX_BUF_NUM 3000
++
++struct mt7915_mcu_csi_report {
++ struct csi_tlv _t0;
++ __le32 ver;
++ struct csi_tlv _t1;
++ __le32 ch_bw;
++ struct csi_tlv _t2;
++ __le32 rssi;
++ struct csi_tlv _t3;
++ __le32 snr;
++ struct csi_tlv _t4;
++ __le32 band;
++ struct csi_tlv _t5;
++ __le32 data_num;
++ struct csi_tlv _t6;
++ __le16 data_i[CSI_MAX_COUNT];
++ struct csi_tlv _t7;
++ __le16 data_q[CSI_MAX_COUNT];
++ struct csi_tlv _t8;
++ __le32 data_bw;
++ struct csi_tlv _t9;
++ __le32 pri_ch_idx;
++ struct csi_tlv _t10;
++ u8 ta[8];
++ struct csi_tlv _t11;
++ __le32 info;
++ struct csi_tlv _t12;
++ __le32 rx_mode;
++ struct csi_tlv _t17;
++ __le32 h_idx;
++ struct csi_tlv _t18;
++ __le32 trx_idx;
++ struct csi_tlv _t19;
++ __le32 ts;
++} __packed;
++
++struct csi_data {
++ u8 ch_bw;
++ u16 data_num;
++ s16 data_i[CSI_MAX_COUNT];
++ s16 data_q[CSI_MAX_COUNT];
++ u8 band;
++ s8 rssi;
++ u8 snr;
++ u32 ts;
++ u8 data_bw;
++ u8 pri_ch_idx;
++ u8 ta[ETH_ALEN];
++ u32 info;
++ u8 rx_mode;
++ u32 h_idx;
++ u16 tx_idx;
++ u16 rx_idx;
++
++ struct list_head node;
++};
++#endif
++
+ #endif
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 2f91020c..8b6c95ef 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -289,6 +289,20 @@ struct mt7915_phy {
+ u8 spe_idx;
+ } test;
+ #endif
++
++#ifdef CONFIG_MTK_VENDOR
++ struct {
++ struct list_head csi_list;
++ spinlock_t csi_lock;
++ u32 count;
++ bool mask;
++ bool reorder;
++ bool enable;
++
++ u32 interval;
++ u32 last_record;
++ } csi;
++#endif
+ };
+
+ struct mt7915_dev {
+@@ -669,6 +683,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ bool pci, int *irq);
+
++#ifdef CONFIG_MTK_VENDOR
++void mt7915_vendor_register(struct mt7915_phy *phy);
++int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
++ u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
++#endif
++
+ #ifdef MTK_DEBUG
+ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
+ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+new file mode 100644
+index 00000000..98fd9c2d
+--- /dev/null
++++ b/mt7915/vendor.c
+@@ -0,0 +1,452 @@
++// SPDX-License-Identifier: ISC
++/*
++ * Copyright (C) 2020, MediaTek Inc. All rights reserved.
++ */
++
++#include <net/netlink.h>
++
++#include "mt7915.h"
++#include "mcu.h"
++#include "vendor.h"
++
++static const struct nla_policy
++csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
++ [MTK_VENDOR_ATTR_CSI_CTRL_CFG] = {.type = NLA_NESTED },
++ [MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR] = { .type = NLA_NESTED },
++ [MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL] = { .type = NLA_U32 },
++ [MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM] = { .type = NLA_U16 },
++ [MTK_VENDOR_ATTR_CSI_CTRL_DATA] = { .type = NLA_NESTED },
++};
++
++struct csi_null_tone {
++ u8 start;
++ u8 end;
++};
++
++struct csi_reorder{
++ u8 dest;
++ u8 start;
++ u8 end;
++};
++
++struct csi_mask {
++ struct csi_null_tone null[10];
++ u8 pilot[8];
++ struct csi_reorder ro[3];
++};
++
++static const struct csi_mask csi_mask_groups[] = {
++ /* OFDM */
++ { .null = { { 0 }, { 27, 37 } },
++ .ro = { {0, 0, 63} },
++ },
++ { .null = { { 0, 69 }, { 96 }, { 123, 127 } },
++ .ro = { { 0, 96 }, { 38, 70, 95 }, { 1, 97, 122 } },
++ },
++ { .null = { { 0, 5 }, { 32 }, { 59, 127 } },
++ .ro = { { 0, 32 }, { 38, 6, 31 }, { 1, 33, 58 } },
++ },
++ { .null = { { 0, 5 }, { 32 }, { 59, 69 }, { 96 }, { 123, 127 } },
++ .ro = { { 0, 0, 127 } },
++ },
++ { .null = { { 0, 133 }, { 160 }, { 187, 255 } },
++ .ro = { { 0, 160 }, { 1, 161, 186 }, { 38, 134, 159 } },
++ },
++ { .null = { { 0, 197 }, { 224 }, { 251, 255 } },
++ .ro = { { 0, 224 }, { 1, 225, 250 }, { 38, 198, 223 } },
++ },
++ { .null = { { 0, 5 }, { 32 }, { 59, 255 } },
++ .ro = { { 0, 32 }, { 1, 33, 58 }, { 38, 6, 31 } },
++ },
++ { .null = { { 0, 69 }, { 96 }, { 123, 255 } },
++ .ro = { { 0, 96 }, { 1, 97, 122 }, { 38, 70, 95 } },
++ },
++ { .null = { { 0, 133 }, { 160 }, { 187, 197 }, { 224 }, { 251, 255 } },
++ .ro = { { 0, 192 }, { 2, 198, 250 }, { 74, 134, 186 } },
++ },
++ { .null = { { 0, 5 }, { 32 }, { 59, 69 }, { 96 }, { 123, 255 } },
++ .ro = { { 0, 64 }, { 2, 70, 122 }, { 74, 6, 58 } },
++ },
++ { .null = { { 0, 5 }, { 32 }, { 59, 69 }, { 96 }, { 123, 133 },
++ { 160 }, { 187, 197 }, { 224 }, { 251, 255 } },
++ .ro = { { 0, 0, 255 } },
++ },
++
++ /* HT/VHT */
++ { .null = { { 0 }, { 29, 35 } },
++ .pilot = { 7, 21, 43, 57 },
++ .ro = { { 0, 0, 63 } },
++ },
++ { .null = { { 0, 67 }, { 96 }, { 125, 127 } },
++ .pilot = { 75, 89, 103, 117 },
++ .ro = { { 0, 96 }, { 36, 68, 95 }, { 1, 97, 124 } },
++ },
++ { .null = { { 0, 3 }, { 32 }, { 61, 127 } },
++ .pilot = { 11, 25, 39, 53 },
++ .ro = { { 0, 32 }, { 36, 4, 31 }, { 1, 33, 60 } },
++ },
++ { .null = { { 0, 1 }, { 59, 69 }, { 127 } },
++ .pilot = { 11, 25, 53, 75, 103, 117 },
++ .ro = { { 0, 0, 127 } },
++ },
++ { .null = { { 0, 131 }, { 160 }, { 189, 255 } },
++ .pilot = { 139, 153, 167, 181 },
++ .ro = { { 0, 160 }, { 1, 161, 188 }, { 36, 132, 159 } },
++ },
++ { .null = { { 0, 195 }, { 224 }, { 253 }, { 255 } },
++ .pilot = { 203, 217, 231, 245 },
++ .ro = { { 0, 224 }, { 1, 225, 252 }, { 36, 196, 223 } },
++ },
++ { .null = { { 0, 3 }, { 32 }, { 61, 255 } },
++ .pilot = { 11, 25, 39, 53 },
++ .ro = { { 0, 32 }, { 1, 33, 60 }, { 36, 4, 31 } },
++ },
++ { .null = { { 0, 67 }, { 96 }, { 125, 255 } },
++ .pilot = { 75, 89, 103, 117 },
++ .ro = { { 0, 96 }, { 1, 97, 124 }, { 36, 68, 95 } },
++ },
++ { .null = { { 0, 133 }, { 191, 193 }, { 251, 255 } },
++ .pilot = { 139, 167, 181, 203, 217, 245 },
++ .ro = { { 0, 192 }, { 2, 194, 250 }, { 70, 134, 190 } },
++ },
++ { .null = { { 0, 5 }, { 63, 65 }, { 123, 127 } },
++ .pilot = { 11, 39, 53, 75, 89, 117 },
++ .ro = { { 0, 64 }, { 2, 66, 122 }, { 70, 6, 62 } },
++ },
++ { .null = { { 0, 1 }, { 123, 133 }, { 255 } },
++ .pilot = { 11, 39, 75, 103, 153, 181, 217, 245 },
++ .ro = { { 0, 0, 255 } },
++ },
++
++ /* HE */
++ { .null = { { 0 }, { 31, 33 } },
++ .pilot = { 12, 29, 35, 52 },
++ .ro = { { 0, 0, 63 } },
++ },
++ { .null = { { 30, 34 }, { 96 } },
++ .pilot = { 4, 21, 43, 60, 70, 87, 105, 122 },
++ .ro = { { 0, 96 }, { 34, 66, 95 }, { 1, 97, 126 } },
++ },
++ { .null = { { 32 }, { 94, 98 } },
++ .pilot = { 6, 23, 41, 58, 68, 85, 107, 124 },
++ .ro = { { 0, 32 }, { 34, 2, 31 }, { 1, 31, 62 } },
++ },
++ { .null = { { 0 }, { 62, 66 } },
++ .pilot = { 9, 26, 36, 53, 75, 92, 102, 119 },
++ .ro = { { 0, 0, 127 } },
++ },
++ { .null = { { 30, 34 }, { 160 } },
++ .pilot = { 4, 21, 43, 60, 137, 154, 166, 183 },
++ .ro = { { 0, 160 }, { 1, 161, 190 }, { 34, 130, 159 } },
++ },
++ { .null = { { 94, 98 }, { 224 } },
++ .pilot = { 68, 85, 107, 124, 201, 218, 230, 247 },
++ .ro = { { 0, 224 }, { 1, 225, 254 }, { 34, 194, 223 } },
++ },
++ { .null = { { 32 }, { 158, 162 } },
++ .pilot = { 9, 26, 38, 55, 132, 149, 171, 188 },
++ .ro = { { 0, 32 }, { 1, 33, 62 }, { 34, 2, 31 } },
++ },
++ { .null = { { 96 }, { 222, 226 } },
++ .pilot = { 73, 90, 102, 119, 196, 213, 235, 252 },
++ .ro = { { 0, 96 }, { 1, 97, 126 }, { 34, 66, 95 } },
++ },
++ { .null = { { 62, 66 }, { 192 } },
++ .pilot = { 36, 53, 75, 92, 169, 186, 198, 215 },
++ .ro = { { 0, 192 }, { 1, 193, 253 }, { 67, 131, 191 } },
++ },
++ { .null = { { 64 }, { 190, 194 } },
++ .pilot = { 41, 58, 70, 87, 164, 181, 203, 220 },
++ .ro = { { 0, 64 }, { 1, 65, 125 }, { 67, 3, 63 } },
++ },
++ { .null = { { 0 }, { 126, 130 } },
++ .pilot = { 6, 23, 100, 117, 139, 156, 233, 250 },
++ .ro = { { 0, 0, 255 } },
++ },
++};
++
++static inline u8 csi_group_idx(u8 mode, u8 ch_bw, u8 data_bw, u8 pri_ch_idx)
++{
++ if (ch_bw < 2 || data_bw < 1)
++ return mode * 11 + ch_bw * ch_bw + pri_ch_idx;
++ else
++ return mode * 11 + ch_bw * ch_bw + (data_bw + 1) * 2 + pri_ch_idx;
++}
++
++static int mt7915_vendor_csi_ctrl(struct wiphy *wiphy,
++ struct wireless_dev *wdev,
++ const void *data,
++ int data_len)
++{
++ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_CSI_CTRL];
++ int err;
++
++ err = nla_parse(tb, MTK_VENDOR_ATTR_CSI_CTRL_MAX, data, data_len,
++ csi_ctrl_policy, NULL);
++ if (err)
++ return err;
++
++ if (tb[MTK_VENDOR_ATTR_CSI_CTRL_CFG]) {
++ u8 mode = 0, type = 0, v1 = 0, v2 = 0;
++ u8 mac_addr[ETH_ALEN] = {};
++ struct nlattr *cur;
++ int rem;
++
++ nla_for_each_nested(cur, tb[MTK_VENDOR_ATTR_CSI_CTRL_CFG], rem) {
++ switch(nla_type(cur)) {
++ case MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE:
++ mode = nla_get_u8(cur);
++ break;
++ case MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE:
++ type = nla_get_u8(cur);
++ break;
++ case MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1:
++ v1 = nla_get_u8(cur);
++ break;
++ case MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2:
++ v2 = nla_get_u8(cur);
++ break;
++ default:
++ return -EINVAL;
++ };
++ }
++
++ if (tb[MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR]) {
++ int idx = 0;
++
++ nla_for_each_nested(cur, tb[MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR], rem) {
++ mac_addr[idx++] = nla_get_u8(cur);
++ }
++ }
++
++ mt7915_mcu_set_csi(phy, mode, type, v1, v2, mac_addr);
++
++ spin_lock_bh(&phy->csi.csi_lock);
++
++ phy->csi.enable = !!mode;
++
++ if (mode == 2 && type == 5) {
++ if (v1 >= 1)
++ phy->csi.mask = 1;
++ if (v1 == 2)
++ phy->csi.reorder = 1;
++ }
++
++ /* clean up old csi stats */
++ if ((mode == 0 || mode == 2) && !list_empty(&phy->csi.csi_list)) {
++ struct csi_data *c, *tmp_c;
++
++ list_for_each_entry_safe(c, tmp_c, &phy->csi.csi_list,
++ node) {
++ list_del(&c->node);
++ kfree(c);
++ phy->csi.count--;
++ }
++ } else if (mode == 1) {
++ phy->csi.last_record = 0;
++ }
++
++ spin_unlock_bh(&phy->csi.csi_lock);
++ }
++
++ if (tb[MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL])
++ phy->csi.interval = nla_get_u32(tb[MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL]);
++
++ return 0;
++}
++
++static void
++mt7915_vendor_csi_tone_mask(struct mt7915_phy *phy, struct csi_data *csi)
++{
++ static const u8 mode_map[] = {
++ [MT_PHY_TYPE_OFDM] = 0,
++ [MT_PHY_TYPE_HT] = 1,
++ [MT_PHY_TYPE_VHT] = 1,
++ [MT_PHY_TYPE_HE_SU] = 2,
++ };
++ const struct csi_mask *cmask;
++ int i;
++
++ if (csi->rx_mode == MT_PHY_TYPE_CCK || !phy->csi.mask)
++ return;
++
++ if (csi->data_bw == IEEE80211_STA_RX_BW_40)
++ csi->pri_ch_idx /= 2;
++
++ cmask = &csi_mask_groups[csi_group_idx(mode_map[csi->rx_mode],
++ csi->ch_bw,
++ csi->data_bw,
++ csi->pri_ch_idx)];
++
++ for (i = 0; i < 10; i++) {
++ const struct csi_null_tone *ntone = &cmask->null[i];
++ u8 start = ntone->start;
++ u8 end = ntone->end;
++ int j;
++
++ if (!start && !end && i > 0)
++ break;
++
++ if (!end)
++ end = start;
++
++ for (j = start; j <= end; j++) {
++ csi->data_i[j] = 0;
++ csi->data_q[j] = 0;
++ }
++ }
++
++ for (i = 0; i < 8; i++) {
++ u8 pilot = cmask->pilot[i];
++
++ if (!pilot)
++ break;
++
++ csi->data_i[pilot] = 0;
++ csi->data_q[pilot] = 0;
++ }
++
++ if (!phy->csi.reorder)
++ return;
++
++ for (i = 0; i < 3; i++) {
++ const struct csi_reorder *ro = &cmask->ro[i];
++ u8 dest = ro->dest;
++ u8 start = ro->start;
++ u8 end = ro->end;
++
++ if (!dest && !start && !end)
++ break;
++
++ if (dest == start)
++ continue;
++
++ if (end) {
++ memmove(&csi->data_i[dest], &csi->data_i[start],
++ end - start + 1);
++ memmove(&csi->data_q[dest], &csi->data_q[start],
++ end - start + 1);
++ } else {
++ csi->data_i[dest] = csi->data_i[start];
++ csi->data_q[dest] = csi->data_q[start];
++ }
++ }
++}
++
++static int
++mt7915_vendor_csi_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
++ struct sk_buff *skb, const void *data, int data_len,
++ unsigned long *storage)
++{
++#define RESERVED_SET BIT(31)
++ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_CSI_CTRL];
++ int err = 0;
++
++ if (*storage & RESERVED_SET) {
++ if ((*storage & GENMASK(15, 0)) == 0)
++ return -ENOENT;
++ (*storage)--;
++ }
++
++ if (data) {
++ err = nla_parse(tb, MTK_VENDOR_ATTR_CSI_CTRL_MAX, data, data_len,
++ csi_ctrl_policy, NULL);
++ if (err)
++ return err;
++ }
++
++ if (!(*storage & RESERVED_SET) && tb[MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM]) {
++ *storage = nla_get_u16(tb[MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM]);
++ *storage |= RESERVED_SET;
++ }
++
++ spin_lock_bh(&phy->csi.csi_lock);
++
++ if (!list_empty(&phy->csi.csi_list)) {
++ struct csi_data *csi;
++ void *a, *b;
++ int i;
++
++ csi = list_first_entry(&phy->csi.csi_list, struct csi_data, node);
++
++ mt7915_vendor_csi_tone_mask(phy, csi);
++
++ a = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_CTRL_DATA);
++
++ if (nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_VER, 1) ||
++ nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_RSSI, csi->rssi) ||
++ nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_SNR, csi->snr) ||
++ nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_BW, csi->data_bw) ||
++ nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_CH_IDX, csi->pri_ch_idx) ||
++ nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_MODE, csi->rx_mode))
++ goto out;
++
++ if (nla_put_u16(skb, MTK_VENDOR_ATTR_CSI_DATA_TX_ANT, csi->tx_idx) ||
++ nla_put_u16(skb, MTK_VENDOR_ATTR_CSI_DATA_RX_ANT, csi->rx_idx))
++ goto out;
++
++ if (nla_put_u32(skb, MTK_VENDOR_ATTR_CSI_DATA_INFO, csi->info) ||
++ nla_put_u32(skb, MTK_VENDOR_ATTR_CSI_DATA_H_IDX, csi->h_idx) ||
++ nla_put_u32(skb, MTK_VENDOR_ATTR_CSI_DATA_TS, csi->ts))
++ goto out;
++
++ b = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_DATA_TA);
++ for (i = 0; i < ARRAY_SIZE(csi->ta); i++)
++ if (nla_put_u8(skb, i, csi->ta[i]))
++ goto out;
++ nla_nest_end(skb, b);
++
++ b = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_DATA_I);
++ for (i = 0; i < ARRAY_SIZE(csi->data_i); i++)
++ if (nla_put_u16(skb, i, csi->data_i[i]))
++ goto out;
++ nla_nest_end(skb, b);
++
++ b = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_DATA_Q);
++ for (i = 0; i < ARRAY_SIZE(csi->data_q); i++)
++ if (nla_put_u16(skb, i, csi->data_q[i]))
++ goto out;
++ nla_nest_end(skb, b);
++
++ nla_nest_end(skb, a);
++
++ list_del(&csi->node);
++ kfree(csi);
++ phy->csi.count--;
++
++ err = phy->csi.count;
++ }
++out:
++ spin_unlock_bh(&phy->csi.csi_lock);
++
++ return err;
++}
++
++static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
++ {
++ .info = {
++ .vendor_id = MTK_NL80211_VENDOR_ID,
++ .subcmd = MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL,
++ },
++ .flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++ WIPHY_VENDOR_CMD_NEED_RUNNING,
++ .doit = mt7915_vendor_csi_ctrl,
++ .dumpit = mt7915_vendor_csi_ctrl_dump,
++ .policy = csi_ctrl_policy,
++ .maxattr = MTK_VENDOR_ATTR_CSI_CTRL_MAX,
++ }
++};
++
++void mt7915_vendor_register(struct mt7915_phy *phy)
++{
++ phy->mt76->hw->wiphy->vendor_commands = mt7915_vendor_commands;
++ phy->mt76->hw->wiphy->n_vendor_commands = ARRAY_SIZE(mt7915_vendor_commands);
++}
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+new file mode 100644
+index 00000000..9d3db2a7
+--- /dev/null
++++ b/mt7915/vendor.h
+@@ -0,0 +1,60 @@
++#ifndef __MT7915_VENDOR_H
++#define __MT7915_VENDOR_H
++
++#define MTK_NL80211_VENDOR_ID 0x0ce7
++
++enum mtk_nl80211_vendor_subcmds {
++ MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
++};
++
++enum mtk_vendor_attr_csi_ctrl {
++ MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2,
++ MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR,
++ MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_DATA,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_CSI_CTRL,
++ MTK_VENDOR_ATTR_CSI_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_CSI_CTRL - 1
++};
++
++enum mtk_vendor_attr_csi_data {
++ MTK_VENDOR_ATTR_CSI_DATA_UNSPEC,
++ MTK_VENDOR_ATTR_CSI_DATA_PAD,
++
++ MTK_VENDOR_ATTR_CSI_DATA_VER,
++ MTK_VENDOR_ATTR_CSI_DATA_TS,
++ MTK_VENDOR_ATTR_CSI_DATA_RSSI,
++ MTK_VENDOR_ATTR_CSI_DATA_SNR,
++ MTK_VENDOR_ATTR_CSI_DATA_BW,
++ MTK_VENDOR_ATTR_CSI_DATA_CH_IDX,
++ MTK_VENDOR_ATTR_CSI_DATA_TA,
++ MTK_VENDOR_ATTR_CSI_DATA_I,
++ MTK_VENDOR_ATTR_CSI_DATA_Q,
++ MTK_VENDOR_ATTR_CSI_DATA_INFO,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD1,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD2,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD3,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD4,
++ MTK_VENDOR_ATTR_CSI_DATA_TX_ANT,
++ MTK_VENDOR_ATTR_CSI_DATA_RX_ANT,
++ MTK_VENDOR_ATTR_CSI_DATA_MODE,
++ MTK_VENDOR_ATTR_CSI_DATA_H_IDX,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_CSI_DATA,
++ MTK_VENDOR_ATTR_CSI_DATA_MAX =
++ NUM_MTK_VENDOR_ATTRS_CSI_DATA - 1
++};
++
++#endif
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
new file mode 100644
index 0000000..1cd5dc0
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
@@ -0,0 +1,549 @@
+From 8d44ea8b90c3fa7020f6d7e31c5d30232fef262c Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Tue, 11 Jan 2022 12:03:23 +0800
+Subject: [PATCH 1003/1010] mt76: mt7915: air monitor support
+
+---
+ mt76_connac_mcu.h | 2 +
+ mt7915/mac.c | 4 +
+ mt7915/main.c | 3 +
+ mt7915/mt7915.h | 34 +++++
+ mt7915/vendor.c | 359 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h | 38 +++++
+ 6 files changed, 440 insertions(+)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 3f35c6fb..55c9fcd5 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1181,6 +1181,8 @@ enum {
+ MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
+ MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
+ MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
++ /* for vendor csi and air monitor */
++ MCU_EXT_CMD_SMESH_CTRL = 0xae,
+ MCU_EXT_CMD_CSI_CTRL = 0xc2,
+ };
+
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 0b13375e..f1c61578 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -549,6 +549,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+ seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
+ qos_ctl = *ieee80211_get_qos_ctl(hdr);
+ }
++#ifdef CONFIG_MTK_VENDOR
++ if (phy->amnt_ctrl.enable)
++ mt7915_vendor_amnt_fill_rx(phy, skb);
++#endif
+ } else {
+ status->flag |= RX_FLAG_8023;
+ mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
+diff --git a/mt7915/main.c b/mt7915/main.c
+index b6e5f97c..11efcadc 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -686,6 +686,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ if (ret)
+ return ret;
+
++#ifdef CONFIG_MTK_VENDOR
++ mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
++#endif
+ return mt7915_mcu_add_rate_ctrl(dev, vif, sta, false);
+ }
+
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 8b6c95ef..bb21433a 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -244,6 +244,35 @@ struct mt7915_hif {
+ int irq;
+ };
+
++#ifdef CONFIG_MTK_VENDOR
++#define MT7915_AIR_MONITOR_MAX_ENTRY 16
++#define MT7915_AIR_MONITOR_MAX_GROUP MT7915_AIR_MONITOR_MAX_ENTRY >> 2
++
++struct mt7915_air_monitor_group {
++ bool enable;
++ bool used[2];
++};
++
++struct mt7915_air_monitor_entry {
++ bool enable;
++
++ u8 group_idx;
++ u8 group_used_idx;
++ u8 muar_idx;
++ u8 addr[ETH_ALEN];
++ unsigned int last_seen;
++ s8 rssi[4];
++ struct ieee80211_sta *sta;
++};
++
++struct mt7915_air_monitor_ctrl {
++ u8 enable;
++
++ struct mt7915_air_monitor_group group[MT7915_AIR_MONITOR_MAX_GROUP];
++ struct mt7915_air_monitor_entry entry[MT7915_AIR_MONITOR_MAX_ENTRY];
++};
++#endif
++
+ struct mt7915_phy {
+ struct mt76_phy *mt76;
+ struct mt7915_dev *dev;
+@@ -302,6 +331,8 @@ struct mt7915_phy {
+ u32 interval;
+ u32 last_record;
+ } csi;
++
++ struct mt7915_air_monitor_ctrl amnt_ctrl;
+ #endif
+ };
+
+@@ -687,6 +718,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ void mt7915_vendor_register(struct mt7915_phy *phy);
+ int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
+ u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
++void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
++int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
++ struct ieee80211_sta *sta);
+ #endif
+
+ #ifdef MTK_DEBUG
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index 98fd9c2d..b94d787e 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -430,6 +430,353 @@ out:
+ return err;
+ }
+
++static const struct nla_policy
++amnt_ctrl_policy[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL] = {
++ [MTK_VENDOR_ATTR_AMNT_CTRL_SET] = {.type = NLA_NESTED },
++ [MTK_VENDOR_ATTR_AMNT_CTRL_DUMP] = { .type = NLA_NESTED },
++};
++
++static const struct nla_policy
++amnt_set_policy[NUM_MTK_VENDOR_ATTRS_AMNT_SET] = {
++ [MTK_VENDOR_ATTR_AMNT_SET_INDEX] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_AMNT_SET_MACADDR] = { .type = NLA_NESTED },
++};
++
++static const struct nla_policy
++amnt_dump_policy[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP] = {
++ [MTK_VENDOR_ATTR_AMNT_DUMP_INDEX] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_AMNT_DUMP_LEN] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_AMNT_DUMP_RESULT] = { .type = NLA_NESTED },
++};
++
++struct mt7915_amnt_data {
++ u8 idx;
++ u8 addr[ETH_ALEN];
++ s8 rssi[4];
++ u32 last_seen;
++};
++
++struct mt7915_smesh {
++ u8 band;
++ u8 write;
++ u8 enable;
++ bool a2;
++ bool a1;
++ bool data;
++ bool mgnt;
++ bool ctrl;
++} __packed;
++
++struct mt7915_smesh_event {
++ u8 band;
++ __le32 value;
++} __packed;
++
++static int
++mt7915_vendor_smesh_ctrl(struct mt7915_phy *phy, u8 write,
++ u8 enable, u32 *value)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct mt7915_smesh req = {
++ .band = phy != &dev->phy,
++ .write = write,
++ .enable = enable,
++ .a2 = 1,
++ .a1 = 1,
++ .data = 1,
++ };
++ struct mt7915_smesh_event *res;
++ struct sk_buff *skb;
++ int ret = 0;
++
++ ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(SMESH_CTRL),
++ &req, sizeof(req), !write, &skb);
++
++ if (ret || write)
++ return ret;
++
++ res = (struct mt7915_smesh_event *) skb->data;
++
++ if (!value)
++ return -EINVAL;
++
++ *value = res->value;
++
++ dev_kfree_skb(skb);
++
++ return 0;
++}
++
++static int
++mt7915_vendor_amnt_muar(struct mt7915_phy *phy, u8 muar_idx, u8 *addr)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ u8 mode;
++ u8 force_clear;
++ u8 clear_bitmap[8];
++ u8 entry_count;
++ u8 write;
++ u8 band;
++
++ u8 index;
++ u8 bssid;
++ u8 addr[ETH_ALEN];
++ } __packed req = {
++ .entry_count = 1,
++ .write = 1,
++ .band = phy != &dev->phy,
++ .index = muar_idx,
++ };
++
++ ether_addr_copy(req.addr, addr);
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
++ sizeof(req), true);
++}
++
++static int
++mt7915_vendor_amnt_set_en(struct mt7915_phy *phy, u8 enable)
++{
++ u32 status;
++ int ret;
++
++ ret = mt7915_vendor_smesh_ctrl(phy, 0, enable, &status);
++ if (ret)
++ return ret;
++
++ status = status & 0xff;
++
++ if (status == enable)
++ return 0;
++
++ ret = mt7915_vendor_smesh_ctrl(phy, 1, enable, &status);
++ if (ret)
++ return ret;
++
++ return 0;
++}
++
++static int
++mt7915_vendor_amnt_set_addr(struct mt7915_phy *phy, u8 index, u8 *addr)
++{
++ struct mt7915_air_monitor_ctrl *amnt_ctrl = &phy->amnt_ctrl;
++ struct mt7915_air_monitor_group *group;
++ struct mt7915_air_monitor_entry *entry = &amnt_ctrl->entry[index];
++ const u8 zero_addr[ETH_ALEN] = {};
++ int enable = !ether_addr_equal(addr, zero_addr);
++ int ret, i, j;
++
++ if (enable == 1 && entry->enable == 1) {
++ ether_addr_copy(entry->addr, addr);
++ } else if (enable == 1 && entry->enable == 0){
++ for (i = 0; i < MT7915_AIR_MONITOR_MAX_GROUP; i++) {
++ group = &(amnt_ctrl->group[i]);
++ if (group->used[0] == 0)
++ j = 0;
++ else
++ j = 1;
++
++ group->enable = 1;
++ group->used[j] = 1;
++ entry->enable = 1;
++ entry->group_idx = i;
++ entry->group_used_idx = j;
++ entry->muar_idx = 32 + 2 * i + 2 * i + 2 * j;
++ ether_addr_copy(entry->addr, addr);
++ break;
++ }
++ } else {
++ group = &(amnt_ctrl->group[entry->group_idx]);
++
++ group->used[entry->group_used_idx] = 0;
++ if (group->used[0] == 0 && group->used[1] == 0)
++ group->enable = 0;
++
++ entry->enable = 0;
++ ether_addr_copy(entry->addr, addr);
++ }
++
++ amnt_ctrl->enable &= ~(1 << entry->group_idx);
++ amnt_ctrl->enable |= entry->enable << entry->group_idx;
++ ret = mt7915_vendor_amnt_muar(phy, entry->muar_idx, addr);
++ if (ret)
++ return ret;
++
++ return mt7915_vendor_amnt_set_en(phy, amnt_ctrl->enable);
++}
++
++void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb)
++{
++ struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
++ struct mt7915_air_monitor_ctrl *ctrl = &phy->amnt_ctrl;
++ struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
++ __le16 fc = hdr->frame_control;
++ u8 addr[ETH_ALEN];
++ int i;
++
++ if (!ieee80211_has_fromds(fc))
++ ether_addr_copy(addr, hdr->addr2);
++ else if (ieee80211_has_tods(fc))
++ ether_addr_copy(addr, hdr->addr4);
++ else
++ ether_addr_copy(addr, hdr->addr3);
++
++ for (i = 0; i < MT7915_AIR_MONITOR_MAX_ENTRY; i++) {
++ struct mt7915_air_monitor_entry *entry;
++
++ if (ether_addr_equal(addr, ctrl->entry[i].addr)) {
++ entry = &ctrl->entry[i];
++ entry->rssi[0] = status->chain_signal[0];
++ entry->rssi[1] = status->chain_signal[1];
++ entry->rssi[2] = status->chain_signal[2];
++ entry->rssi[3] = status->chain_signal[3];
++ entry->last_seen = jiffies;
++ }
++ }
++
++ if (ieee80211_has_tods(fc) &&
++ !ether_addr_equal(hdr->addr3, phy->mt76->macaddr))
++ return;
++ else if (!ether_addr_equal(hdr->addr1, phy->mt76->macaddr))
++ return;
++}
++
++int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
++ struct ieee80211_sta *sta)
++{
++ u8 zero[ETH_ALEN] = {};
++ int i;
++
++ if (!phy->amnt_ctrl.enable)
++ return 0;
++
++ for (i = 0; i < MT7915_AIR_MONITOR_MAX_ENTRY; i++)
++ if (ether_addr_equal(sta->addr, phy->amnt_ctrl.entry[i].addr))
++ return mt7915_vendor_amnt_set_addr(phy, i, zero);
++
++ return 0;
++}
++
++static int
++mt7915_vendor_amnt_ctrl(struct wiphy *wiphy, struct wireless_dev *wdev,
++ const void *data, int data_len)
++{
++ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct nlattr *tb1[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL];
++ struct nlattr *tb2[NUM_MTK_VENDOR_ATTRS_AMNT_SET];
++ struct nlattr *cur;
++ u8 index = 0, i = 0;
++ u8 mac_addr[ETH_ALEN] = {};
++ int err, rem;
++
++ err = nla_parse(tb1, MTK_VENDOR_ATTR_AMNT_CTRL_MAX, data, data_len,
++ amnt_ctrl_policy, NULL);
++ if (err)
++ return err;
++
++ if (!tb1[MTK_VENDOR_ATTR_AMNT_CTRL_SET])
++ return -EINVAL;
++
++ err = nla_parse_nested(tb2, MTK_VENDOR_ATTR_AMNT_SET_MAX,
++ tb1[MTK_VENDOR_ATTR_AMNT_CTRL_SET], amnt_set_policy, NULL);
++
++ if (!tb2[MTK_VENDOR_ATTR_AMNT_SET_INDEX] ||
++ !tb2[MTK_VENDOR_ATTR_AMNT_SET_MACADDR])
++ return -EINVAL;
++
++ index = nla_get_u8(tb2[MTK_VENDOR_ATTR_AMNT_SET_INDEX]);
++ nla_for_each_nested(cur, tb2[MTK_VENDOR_ATTR_AMNT_SET_MACADDR], rem) {
++ mac_addr[i++] = nla_get_u8(cur);
++ }
++
++ return mt7915_vendor_amnt_set_addr(phy, index, mac_addr);
++}
++
++static int
++mt7915_amnt_dump(struct mt7915_phy *phy, struct sk_buff *skb,
++ u8 amnt_idx, int *attrtype)
++{
++ struct mt7915_air_monitor_entry *entry =
++ &phy->amnt_ctrl.entry[amnt_idx];
++ struct mt7915_amnt_data data;
++ u32 last_seen = 0;
++
++ if (entry->enable == 0)
++ return 0;
++
++ last_seen = jiffies_to_msecs(jiffies - entry->last_seen);
++
++ data.idx = amnt_idx;
++ ether_addr_copy(data.addr, entry->addr);
++ data.rssi[0] = entry->rssi[0];
++ data.rssi[1] = entry->rssi[1];
++ data.rssi[2] = entry->rssi[2];
++ data.rssi[3] = entry->rssi[3];
++ data.last_seen = last_seen;
++
++ nla_put(skb, (*attrtype)++, sizeof(struct mt7915_amnt_data), &data);
++
++ return 1;
++}
++
++static int
++mt7915_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
++ struct sk_buff *skb, const void *data, int data_len,
++ unsigned long *storage)
++{
++ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct nlattr *tb1[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL];
++ struct nlattr *tb2[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP];
++ void *a, *b;
++ int err = 0, attrtype = 0, i, len = 0;
++ u8 amnt_idx;
++
++ if (*storage == 1)
++ return -ENOENT;
++ *storage = 1;
++
++ err = nla_parse(tb1, MTK_VENDOR_ATTR_AMNT_CTRL_MAX, data, data_len,
++ amnt_ctrl_policy, NULL);
++ if (err)
++ return err;
++
++ if (!tb1[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP])
++ return -EINVAL;
++
++ err = nla_parse_nested(tb2, MTK_VENDOR_ATTR_AMNT_DUMP_MAX,
++ tb1[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP],
++ amnt_dump_policy, NULL);
++ if (err)
++ return err;
++
++ if (!tb2[MTK_VENDOR_ATTR_AMNT_DUMP_INDEX])
++ return -EINVAL;
++
++ amnt_idx = nla_get_u8(tb2[MTK_VENDOR_ATTR_AMNT_DUMP_INDEX]);
++
++ a = nla_nest_start(skb, MTK_VENDOR_ATTR_AMNT_CTRL_DUMP);
++ b = nla_nest_start(skb, MTK_VENDOR_ATTR_AMNT_DUMP_RESULT);
++
++ if (amnt_idx != 0xff) {
++ len += mt7915_amnt_dump(phy, skb, amnt_idx, &attrtype);
++ } else {
++ for (i = 0; i < MT7915_AIR_MONITOR_MAX_ENTRY; i++) {
++ len += mt7915_amnt_dump(phy, skb, i, &attrtype);
++ }
++ }
++
++ nla_nest_end(skb, b);
++
++ nla_put_u8(skb, MTK_VENDOR_ATTR_AMNT_DUMP_LEN, len);
++
++ nla_nest_end(skb, a);
++
++ return len + 1;
++}
++
+ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ {
+ .info = {
+@@ -442,6 +789,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ .dumpit = mt7915_vendor_csi_ctrl_dump,
+ .policy = csi_ctrl_policy,
+ .maxattr = MTK_VENDOR_ATTR_CSI_CTRL_MAX,
++ },
++ {
++ .info = {
++ .vendor_id = MTK_NL80211_VENDOR_ID,
++ .subcmd = MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL,
++ },
++ .flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++ WIPHY_VENDOR_CMD_NEED_RUNNING,
++ .doit = mt7915_vendor_amnt_ctrl,
++ .dumpit = mt7915_vendor_amnt_ctrl_dump,
++ .policy = amnt_ctrl_policy,
++ .maxattr = MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
+ }
+ };
+
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index 9d3db2a7..976817f3 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -4,6 +4,7 @@
+ #define MTK_NL80211_VENDOR_ID 0x0ce7
+
+ enum mtk_nl80211_vendor_subcmds {
++ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
+ MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
+ };
+
+@@ -57,4 +58,41 @@ enum mtk_vendor_attr_csi_data {
+ NUM_MTK_VENDOR_ATTRS_CSI_DATA - 1
+ };
+
++enum mtk_vendor_attr_mnt_ctrl {
++ MTK_VENDOR_ATTR_AMNT_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_CTRL_SET,
++ MTK_VENDOR_ATTR_AMNT_CTRL_DUMP,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_CTRL,
++ MTK_VENDOR_ATTR_AMNT_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_CTRL - 1
++};
++
++enum mtk_vendor_attr_mnt_set {
++ MTK_VENDOR_ATTR_AMNT_SET_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_SET_INDEX,
++ MTK_VENDOR_ATTR_AMNT_SET_MACADDR,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_SET,
++ MTK_VENDOR_ATTR_AMNT_SET_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_SET - 1
++};
++
++enum mtk_vendor_attr_mnt_dump {
++ MTK_VENDOR_ATTR_AMNT_DUMP_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_DUMP_INDEX,
++ MTK_VENDOR_ATTR_AMNT_DUMP_LEN,
++ MTK_VENDOR_ATTR_AMNT_DUMP_RESULT,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_DUMP,
++ MTK_VENDOR_ATTR_AMNT_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_DUMP - 1
++};
++
+ #endif
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
new file mode 100644
index 0000000..4b30a6e
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -0,0 +1,119 @@
+From d59ea5f5af1478aa25b8723f9c8064c244175a50 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Wed, 22 Jun 2022 10:45:53 +0800
+Subject: [PATCH 1004/1010] mt76: mt7915: add support for muru_onoff via
+ debugfs
+
+---
+ mt7915/init.c | 1 +
+ mt7915/mcu.c | 9 +++++++--
+ mt7915/mcu.h | 6 ++++++
+ mt7915/mtk_debugfs.c | 33 +++++++++++++++++++++++++++++++++
+ 4 files changed, 47 insertions(+), 2 deletions(-)
+
+diff --git a/mt7915/init.c b/mt7915/init.c
+index 34ace7c9..d4105835 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -609,6 +609,7 @@ static void mt7915_init_work(struct work_struct *work)
+ mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
+ mt7915_init_txpower(dev, &dev->mphy.sband_6g.sband);
+ mt7915_txbf_init(dev);
++ dev->dbg.muru_onoff = OFDMA_DL | MUMIMO_UL | MUMIMO_DL;
+ }
+
+ void mt7915_wfsys_reset(struct mt7915_dev *dev)
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index e6cd1e2c..2ee4afe9 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -860,13 +860,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+
+ muru = (struct sta_rec_muru *)tlv;
+
+- muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
++ muru->cfg.mimo_dl_en = (mvif->cap.he_mu_ebfer ||
+ mvif->cap.vht_mu_ebfer ||
+- mvif->cap.vht_mu_ebfee;
++ mvif->cap.vht_mu_ebfee) &&
++ !!(dev->dbg.muru_onoff & MUMIMO_DL);
+ if (!is_mt7915(&dev->mt76))
+ muru->cfg.mimo_ul_en = true;
+ muru->cfg.ofdma_dl_en = true;
+
++ muru->cfg.mimo_ul_en = !!(dev->dbg.muru_onoff & MUMIMO_UL);
++ muru->cfg.ofdma_dl_en = !!(dev->dbg.muru_onoff & OFDMA_DL);
++ muru->cfg.ofdma_ul_en = !!(dev->dbg.muru_onoff & OFDMA_UL);
++
+ if (sta->vht_cap.vht_supported)
+ muru->mimo_dl.vht_mu_bfee =
+ !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 50bf4cb6..aa07e426 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -589,4 +589,10 @@ struct csi_data {
+ };
+ #endif
+
++/* MURU */
++#define OFDMA_DL BIT(0)
++#define OFDMA_UL BIT(1)
++#define MUMIMO_DL BIT(2)
++#define MUMIMO_UL BIT(3)
++
+ #endif
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index 747a9014..176937ad 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -2480,6 +2480,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
+ return 0;
+ }
+
++static int mt7915_muru_onoff_get(void *data, u64 *val)
++{
++ struct mt7915_dev *dev = data;
++
++ *val = dev->dbg.muru_onoff;
++
++ printk("mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
++ !!(dev->dbg.muru_onoff & MUMIMO_UL),
++ !!(dev->dbg.muru_onoff & MUMIMO_DL),
++ !!(dev->dbg.muru_onoff & OFDMA_UL),
++ !!(dev->dbg.muru_onoff & OFDMA_DL));
++
++ return 0;
++}
++
++static int mt7915_muru_onoff_set(void *data, u64 val)
++{
++ struct mt7915_dev *dev = data;
++
++ if (val > 15) {
++ printk("Wrong value! The value is between 0 ~ 15.\n");
++ goto exit;
++ }
++
++ dev->dbg.muru_onoff = val;
++exit:
++ return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_muru_onoff, mt7915_muru_onoff_get,
++ mt7915_muru_onoff_set, "%llx\n");
++
+ static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
+ {
+ struct mt7915_dev *dev = dev_get_drvdata(s->private);
+@@ -2859,6 +2891,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+
+ mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
+
++ debugfs_create_file("muru_onoff", 0600, dir, dev, &fops_muru_onoff);
+ debugfs_create_file("fw_debug_module", 0600, dir, dev,
+ &fops_fw_debug_module);
+ debugfs_create_file("fw_debug_level", 0600, dir, dev,
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
new file mode 100644
index 0000000..209d039
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
@@ -0,0 +1,1138 @@
+From b9b4a77af1657e0b71a6f57dc8c8c2d50c37a946 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Mon, 6 Jun 2022 20:15:51 +0800
+Subject: [PATCH 1005/1010] mt76: mt7915: certification patches
+
+---
+ mt76_connac_mcu.h | 1 +
+ mt7915/mac.c | 23 +++
+ mt7915/main.c | 15 +-
+ mt7915/mcu.c | 466 +++++++++++++++++++++++++++++++++++++++++++
+ mt7915/mcu.h | 207 ++++++++++++++++++-
+ mt7915/mt7915.h | 13 ++
+ mt7915/mtk_debugfs.c | 7 +-
+ mt7915/vendor.c | 187 +++++++++++++++++
+ mt7915/vendor.h | 42 ++++
+ 9 files changed, 956 insertions(+), 5 deletions(-)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 55c9fcd5..0d4d466f 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1183,6 +1183,7 @@ enum {
+ MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
+ /* for vendor csi and air monitor */
+ MCU_EXT_CMD_SMESH_CTRL = 0xae,
++ MCU_EXT_CMD_CERT_CFG = 0xb7,
+ MCU_EXT_CMD_CSI_CTRL = 0xc2,
+ };
+
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index f1c61578..cf119cf4 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -8,6 +8,7 @@
+ #include "../dma.h"
+ #include "mac.h"
+ #include "mcu.h"
++#include "vendor.h"
+
+ #define to_rssi(field, rcpi) ((FIELD_GET(field, rcpi) - 220) / 2)
+
+@@ -2020,6 +2021,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+ phy->trb_ts = trb;
+ }
+
++#ifdef CONFIG_MTK_VENDOR
++void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
++{
++ struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
++ struct mt7915_dev *dev = msta->vif->phy->dev;
++ u32 *changed = data;
++
++ spin_lock_bh(&dev->sta_poll_lock);
++ msta->changed |= *changed;
++ if (list_empty(&msta->rc_list))
++ list_add_tail(&msta->rc_list, &dev->sta_rc_list);
++ spin_unlock_bh(&dev->sta_poll_lock);
++}
++#endif
++
+ void mt7915_mac_sta_rc_work(struct work_struct *work)
+ {
+ struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
+@@ -2042,6 +2058,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+ sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
+ vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
+
++#ifdef CONFIG_MTK_VENDOR
++ if (changed & CAPI_RFEATURE_CHANGED) {
++ mt7915_mcu_set_rfeature_starec(&changed, dev, vif, sta);
++ spin_lock_bh(&dev->sta_poll_lock);
++ continue;
++ }
++#endif
+ if (changed & (IEEE80211_RC_SUPP_RATES_CHANGED |
+ IEEE80211_RC_NSS_CHANGED |
+ IEEE80211_RC_BW_CHANGED))
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 11efcadc..75073363 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -662,6 +662,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
+ struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+ bool ext_phy = mvif->phy != &dev->phy;
++#ifdef CONFIG_MTK_VENDOR
++ struct mt7915_phy *phy;
++#endif
+ int ret, idx;
+
+ idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
+@@ -689,7 +692,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ #ifdef CONFIG_MTK_VENDOR
+ mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
+ #endif
+- return mt7915_mcu_add_rate_ctrl(dev, vif, sta, false);
++ ret = mt7915_mcu_add_rate_ctrl(dev, vif, sta, false);
++ if (ret)
++ return ret;
++
++#ifdef CONFIG_MTK_VENDOR
++ if (dev->dbg.muru_onoff & MUMIMO_DL_CERT) {
++ phy = mvif->mt76.band_idx ? mt7915_ext_phy(dev) : &dev->phy;
++ mt7915_mcu_set_mimo(phy, 0);
++ }
++#endif
++ return 0;
+ }
+
+ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 2ee4afe9..fe314bf2 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -3865,6 +3865,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+
+ return 0;
+ }
++void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
++{
++ u8 mode, val;
++ struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++ struct mt7915_dev *dev = mvif->phy->dev;
++
++ mode = FIELD_GET(RATE_CFG_MODE, *((u32 *)data));
++ val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
++
++ switch (mode) {
++ case RATE_PARAM_FIXED_OFDMA:
++ if (val == 3) /* DL 20 and 80 */
++ dev->dbg.muru_onoff = OFDMA_DL; /* Enable OFDMA DL only */
++ else
++ dev->dbg.muru_onoff = val;
++ break;
++ case RATE_PARAM_FIXED_MIMO:
++ if (val == 0)
++ dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
++ break;
++ }
++}
++
++void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
++ struct ieee80211_vif *vif, struct ieee80211_sta *sta)
++{
++ struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
++ struct mt7915_vif *mvif = msta->vif;
++ struct sta_rec_ra_fixed *ra;
++ struct sk_buff *skb;
++ struct tlv *tlv;
++ u8 mode, val;
++ int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
++
++ mode = FIELD_GET(RATE_CFG_MODE, *((u32 *)data));
++ val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
++
++ skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, &msta->wcid, len);
++ if (IS_ERR(skb))
++ return;
++
++ tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
++ ra = (struct sta_rec_ra_fixed *)tlv;
++
++ switch (mode) {
++ case RATE_PARAM_FIXED_GI:
++ ra->field = cpu_to_le32(RATE_PARAM_FIXED_GI);
++ ra->phy.sgi = val * 85;
++ break;
++ case RATE_PARAM_FIXED_HE_LTF:
++ ra->field = cpu_to_le32(RATE_PARAM_FIXED_HE_LTF);
++ ra->phy.he_ltf = val * 85;
++ break;
++ case RATE_PARAM_FIXED_MCS:
++ ra->field = cpu_to_le32(RATE_PARAM_FIXED_MCS);
++ ra->phy.mcs = val;
++ break;
++ }
++
++ mt76_mcu_skb_send_msg(&dev->mt76, skb,
++ MCU_EXT_CMD(STA_REC_UPDATE), true);
++}
++
++int mt7915_mcu_set_mu_prot_frame_th(struct mt7915_phy *phy, u32 val)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ __le32 cmd;
++ __le32 threshold;
++ } __packed req = {
++ .cmd = cpu_to_le32(MURU_SET_PROT_FRAME_THR),
++ .threshold = val,
++ };
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++ sizeof(req), false);
++}
++
++int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ __le32 cmd;
++ u8 override;
++ } __packed req = {
++ .cmd = cpu_to_le32(MURU_SET_CERT_MU_EDCA_OVERRIDE),
++ .override = val,
++ };
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++ sizeof(req), false);
++}
++
++int mt7915_mcu_set_muru_cfg(struct mt7915_phy *phy, struct mt7915_muru *muru)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ __le32 cmd;
++ struct mt7915_muru muru;
++ } __packed req = {
++ .cmd = cpu_to_le32(MURU_SET_MANUAL_CFG),
++ };
++
++ memcpy(&req.muru, muru, sizeof(struct mt7915_muru));
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++ sizeof(req), false);
++}
++
++int mt7915_set_muru_cfg(struct mt7915_phy *phy, u8 action, u8 val)
++{
++ struct mt7915_muru muru;
++ struct mt7915_muru_dl *dl = &muru.dl;
++ struct mt7915_muru_ul *ul = &muru.ul;
++ struct mt7915_muru_comm *comm = &muru.comm;
++
++ memset(&muru, 0, sizeof(muru));
++
++ switch (action) {
++ case MURU_DL_USER_CNT:
++ dl->user_num = val;
++ comm->ppdu_format |= MURU_PPDU_HE_MU;
++ comm->sch_type |= MURU_OFDMA_SCH_TYPE_DL;
++ muru.cfg_comm = cpu_to_le32(MURU_COMM_SET);
++ muru.cfg_dl = cpu_to_le32(MURU_USER_CNT);
++ return mt7915_mcu_set_muru_cfg(phy, &muru);
++ case MURU_UL_USER_CNT:
++ ul->user_num = val;
++ comm->ppdu_format |= MURU_PPDU_HE_TRIG;
++ comm->sch_type |= MURU_OFDMA_SCH_TYPE_UL;
++ muru.cfg_comm = cpu_to_le32(MURU_COMM_SET);
++ muru.cfg_ul = cpu_to_le32(MURU_USER_CNT);
++ return mt7915_mcu_set_muru_cfg(phy, &muru);
++ default:
++ return 0;
++ }
++}
++
++void mt7915_mcu_set_ppdu_tx_type(struct mt7915_phy *phy, u8 ppdu_type)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ __le32 cmd;
++ u8 enable_su;
++ } __packed ppdu_type_req = {
++ .cmd = cpu_to_le32(MURU_SET_SUTX),
++ };
++
++ switch(ppdu_type) {
++ case CAPI_SU:
++ ppdu_type_req.enable_su = 1;
++ mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
++ &ppdu_type_req, sizeof(ppdu_type_req), false);
++ mt7915_set_muru_cfg(phy, MURU_DL_USER_CNT, 0);
++ break;
++ case CAPI_MU:
++ ppdu_type_req.enable_su = 0;
++ mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
++ &ppdu_type_req, sizeof(ppdu_type_req), false);
++ break;
++ default:
++ break;
++ }
++}
++
++void mt7915_mcu_set_nusers_ofdma(struct mt7915_phy *phy, u8 type, u8 ofdma_user_cnt)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ __le32 cmd;
++ u8 enable_su;
++ } __packed nusers_ofdma_req = {
++ .cmd = cpu_to_le32(MURU_SET_SUTX),
++ .enable_su = 0,
++ };
++
++ mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
++ &nusers_ofdma_req, sizeof(nusers_ofdma_req), false);
++
++ mt7915_mcu_set_mu_dl_ack_policy(phy, MU_DL_ACK_POLICY_SU_BAR);
++ mt7915_mcu_set_mu_prot_frame_th(phy, 9999);
++ switch(type) {
++ case MURU_UL_USER_CNT:
++ mt7915_set_muru_cfg(phy, MURU_UL_USER_CNT, ofdma_user_cnt);
++ break;
++ case MURU_DL_USER_CNT:
++ default:
++ mt7915_set_muru_cfg(phy, MURU_DL_USER_CNT, ofdma_user_cnt);
++ break;
++ }
++}
++
++void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction)
++{
++#define MUMIMO_SET_FIXED_RATE 10
++#define MUMIMO_SET_FIXED_GRP_RATE 11
++#define MUMIMO_SET_FORCE_MU 12
++ struct mt7915_dev *dev = phy->dev;
++ struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
++ struct {
++ __le32 cmd;
++ __le16 sub_cmd;
++ __le16 disable_ra;
++ } __packed fixed_rate_req = {
++ .cmd = cpu_to_le32(MURU_SET_MUMIMO_CTRL),
++ .sub_cmd = cpu_to_le16(MUMIMO_SET_FIXED_RATE),
++ .disable_ra = cpu_to_le16(1),
++ };
++ struct {
++ __le32 cmd;
++ __le32 sub_cmd;
++ struct {
++ u8 user_cnt:2;
++ u8 rsv:2;
++ u8 ns0:1;
++ u8 ns1:1;
++ u8 ns2:1;
++ u8 ns3:1;
++
++ __le16 wlan_id_user0;
++ __le16 wlan_id_user1;
++ __le16 wlan_id_user2;
++ __le16 wlan_id_user3;
++
++ u8 dl_mcs_user0:4;
++ u8 dl_mcs_user1:4;
++ u8 dl_mcs_user2:4;
++ u8 dl_mcs_user3:4;
++
++ u8 ul_mcs_user0:4;
++ u8 ul_mcs_user1:4;
++ u8 ul_mcs_user2:4;
++ u8 ul_mcs_user3:4;
++
++ u8 ru_alloc;
++ u8 cap;
++ u8 gi;
++ u8 dl_ul;
++ } grp_rate_conf;
++ } fixed_grp_rate_req = {
++ .cmd = cpu_to_le32(MURU_SET_MUMIMO_CTRL),
++ .sub_cmd = cpu_to_le32(MUMIMO_SET_FIXED_GRP_RATE),
++ .grp_rate_conf = {
++ .user_cnt = 1,
++ .ru_alloc = 134,
++ .gi = 0,
++ .cap = 1,
++ .dl_ul = 0,
++ .wlan_id_user0 = cpu_to_le16(1),
++ .dl_mcs_user0 = 2,
++ .wlan_id_user1 = cpu_to_le16(2),
++ .dl_mcs_user1 = 2,
++ },
++ };
++ struct {
++ __le32 cmd;
++ __le16 sub_cmd;
++ bool force_mu;
++ } __packed force_mu_req = {
++ .cmd = cpu_to_le32(MURU_SET_MUMIMO_CTRL),
++ .sub_cmd = cpu_to_le16(MUMIMO_SET_FORCE_MU),
++ .force_mu = true,
++ };
++
++ switch (chandef->width) {
++ case NL80211_CHAN_WIDTH_20_NOHT:
++ case NL80211_CHAN_WIDTH_20:
++ fixed_grp_rate_req.grp_rate_conf.ru_alloc = 122;
++ break;
++ case NL80211_CHAN_WIDTH_80:
++ default:
++ break;
++ }
++
++ mt7915_mcu_set_mu_dl_ack_policy(phy, MU_DL_ACK_POLICY_SU_BAR);
++
++ mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
++ &fixed_rate_req, sizeof(fixed_rate_req), false);
++ mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
++ &fixed_grp_rate_req, sizeof(fixed_grp_rate_req), false);
++ mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
++ &force_mu_req, sizeof(force_mu_req), false);
++}
++
++void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ __le32 cmd;
++ u8 enable;
++ } __packed req = {
++ .cmd = cpu_to_le32(MURU_SET_20M_DYN_ALGO),
++ .enable = enable,
++ };
++
++ mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
++ &req, sizeof(req), false);
++}
++
++void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type)
++{
++#define CFGINFO_CERT_CFG 4
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ struct basic_info{
++ u8 dbdc_idx;
++ u8 rsv[3];
++ __le32 tlv_num;
++ u8 tlv_buf[0];
++ } hdr;
++ struct cert_cfg{
++ __le16 tag;
++ __le16 length;
++ u8 cert_program;
++ u8 rsv[3];
++ } tlv;
++ } req = {
++ .hdr = {
++ .dbdc_idx = phy != &dev->phy,
++ .tlv_num = cpu_to_le32(1),
++ },
++ .tlv = {
++ .tag = cpu_to_le16(CFGINFO_CERT_CFG),
++ .length = cpu_to_le16(sizeof(struct cert_cfg)),
++ .cert_program = type, /* 1: CAPI Enable */
++ }
++ };
++
++ mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CERT_CFG),
++ &req, sizeof(req), false);
++}
++
++void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
++{
++#define BF_CMD_CFG_PHY 36
++#define BF_PHY_SMTH_INTL_BYPASS 0
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ u8 cmd_category_id;
++ u8 action;
++ u8 band_idx;
++ u8 smthintbypass;
++ u8 rsv[12];
++ } req = {
++ .cmd_category_id = BF_CMD_CFG_PHY,
++ .action = BF_PHY_SMTH_INTL_BYPASS,
++ .band_idx = phy != &dev->phy,
++ .smthintbypass = val,
++ };
++
++ mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
++ &req, sizeof(req), false);
++}
++
++int mt7915_mcu_set_bsrp_ctrl(struct mt7915_phy *phy, u16 interval,
++ u16 ru_alloc, u32 ppdu_dur, u8 trig_flow, u8 ext_cmd)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ __le32 cmd;
++ __le16 bsrp_interval;
++ __le16 bsrp_ru_alloc;
++ __le32 ppdu_duration;
++ u8 trigger_flow;
++ u8 ext_cmd_bsrp;
++ } __packed req = {
++ .cmd = cpu_to_le32(MURU_SET_BSRP_CTRL),
++ .bsrp_interval = cpu_to_le16(interval),
++ .bsrp_ru_alloc = cpu_to_le16(ru_alloc),
++ .ppdu_duration = cpu_to_le32(ppdu_dur),
++ .trigger_flow = trig_flow,
++ .ext_cmd_bsrp = ext_cmd,
++ };
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++ sizeof(req), false);
++}
++
++int mt7915_mcu_set_mu_dl_ack_policy(struct mt7915_phy *phy, u8 policy_num)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ __le32 cmd;
++ u8 ack_policy;
++ } __packed req = {
++ .cmd = cpu_to_le32(MURU_SET_MU_DL_ACK_POLICY),
++ .ack_policy = policy_num,
++ };
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++ sizeof(req), false);
++}
++
++int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
++ u8 v1, u8 v2, u8 v3)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ u8 cmd_category_id;
++ u8 action;
++ u8 read_clear;
++ u8 vht_opt;
++ u8 he_opt;
++ u8 glo_opt;
++ __le16 wlan_idx;
++ u8 sound_interval;
++ u8 sound_stop;
++ u8 max_sound_sta;
++ u8 tx_time;
++ u8 mcs;
++ bool ldpc;
++ u8 inf;
++ u8 rsv;
++ } __packed req = {
++ .cmd_category_id = BF_CMD_TXSND_INFO,
++ .action = action,
++ };
++
++ switch (action) {
++ case BF_SND_CFG_OPT:
++ req.vht_opt = v1;
++ req.he_opt = v2;
++ req.glo_opt = v3;
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++ sizeof(req), false);
++}
++
++int mt7915_mcu_set_rfeature_trig_type(struct mt7915_phy *phy, u8 enable, u8 trig_type)
++{
++ struct mt7915_dev *dev = phy->dev;
++ int ret = 0;
++ struct {
++ __le32 cmd;
++ u8 trig_type;
++ } __packed req = {
++ .cmd = cpu_to_le32(MURU_SET_TRIG_TYPE),
++ .trig_type = trig_type,
++ };
++
++ if (enable) {
++ ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++ sizeof(req), false);
++ if (ret)
++ return ret;
++ }
++
++ switch (trig_type) {
++ case CAPI_BASIC:
++ return mt7915_mcu_set_bsrp_ctrl(phy, 5, 67, 0, 0, enable);
++ case CAPI_BRP:
++ return mt7915_mcu_set_txbf_sound_info(phy, BF_SND_CFG_OPT,
++ 0x0, 0x0, 0x1b);
++ case CAPI_MU_BAR:
++ return mt7915_mcu_set_mu_dl_ack_policy(phy,
++ MU_DL_ACK_POLICY_MU_BAR);
++ case CAPI_BSRP:
++ return mt7915_mcu_set_bsrp_ctrl(phy, 5, 67, 4, 0, enable);
++ default:
++ return 0;
++ }
++}
+ #endif
+
+ #ifdef MTK_DEBUG
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index aa07e426..6d4580bf 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -408,10 +408,14 @@ enum {
+ RATE_PARAM_FIXED = 3,
+ RATE_PARAM_MMPS_UPDATE = 5,
+ RATE_PARAM_FIXED_HE_LTF = 7,
+- RATE_PARAM_FIXED_MCS,
++ RATE_PARAM_FIXED_MCS = 8,
+ RATE_PARAM_FIXED_GI = 11,
+ RATE_PARAM_AUTO = 20,
+ RATE_PARAM_SPE_UPDATE = 22,
++#ifdef CONFIG_MTK_VENDOR
++ RATE_PARAM_FIXED_MIMO = 30,
++ RATE_PARAM_FIXED_OFDMA = 31,
++#endif
+ };
+
+ #define RATE_CFG_MCS GENMASK(3, 0)
+@@ -423,6 +427,9 @@ enum {
+ #define RATE_CFG_PHY_TYPE GENMASK(27, 24)
+ #define RATE_CFG_HE_LTF GENMASK(31, 28)
+
++#define RATE_CFG_MODE GENMASK(15, 8)
++#define RATE_CFG_VAL GENMASK(7, 0)
++
+ enum {
+ TX_POWER_LIMIT_ENABLE,
+ TX_POWER_LIMIT_TABLE = 0x4,
+@@ -594,5 +601,203 @@ struct csi_data {
+ #define OFDMA_UL BIT(1)
+ #define MUMIMO_DL BIT(2)
+ #define MUMIMO_UL BIT(3)
++#define MUMIMO_DL_CERT BIT(4)
++
++#ifdef CONFIG_MTK_VENDOR
++struct mt7915_muru_comm {
++ u8 ppdu_format;
++ u8 sch_type;
++ u8 band;
++ u8 wmm_idx;
++ u8 spe_idx;
++ u8 proc_type;
++};
++
++struct mt7915_muru_dl {
++ u8 user_num;
++ u8 tx_mode;
++ u8 bw;
++ u8 gi;
++ u8 ltf;
++ /* sigB */
++ u8 mcs;
++ u8 dcm;
++ u8 cmprs;
++
++ u8 ru[8];
++ u8 c26[2];
++ u8 ack_policy;
++
++ struct {
++ __le16 wlan_idx;
++ u8 ru_alloc_seg;
++ u8 ru_idx;
++ u8 ldpc;
++ u8 nss;
++ u8 mcs;
++ u8 mu_group_idx;
++ u8 vht_groud_id;
++ u8 vht_up;
++ u8 he_start_stream;
++ u8 he_mu_spatial;
++ u8 ack_policy;
++ __le16 tx_power_alpha;
++ } usr[16];
++};
++
++struct mt7915_muru_ul {
++ u8 user_num;
++
++ /* UL TX */
++ u8 trig_type;
++ __le16 trig_cnt;
++ __le16 trig_intv;
++ u8 bw;
++ u8 gi_ltf;
++ __le16 ul_len;
++ u8 pad;
++ u8 trig_ta[ETH_ALEN];
++ u8 ru[8];
++ u8 c26[2];
++
++ struct {
++ __le16 wlan_idx;
++ u8 ru_alloc;
++ u8 ru_idx;
++ u8 ldpc;
++ u8 nss;
++ u8 mcs;
++ u8 target_rssi;
++ __le32 trig_pkt_size;
++ } usr[16];
++
++ /* HE TB RX Debug */
++ __le32 rx_hetb_nonsf_en_bitmap;
++ __le32 rx_hetb_cfg[2];
++
++ /* DL TX */
++ u8 ba_type;
++};
++
++struct mt7915_muru {
++ __le32 cfg_comm;
++ __le32 cfg_dl;
++ __le32 cfg_ul;
++
++ struct mt7915_muru_comm comm;
++ struct mt7915_muru_dl dl;
++ struct mt7915_muru_ul ul;
++};
++
++#define MURU_PPDU_HE_TRIG BIT(2)
++#define MURU_PPDU_HE_MU BIT(3)
++
++#define MURU_OFDMA_SCH_TYPE_DL BIT(0)
++#define MURU_OFDMA_SCH_TYPE_UL BIT(1)
++
++/* Common Config */
++#define MURU_COMM_PPDU_FMT BIT(0)
++#define MURU_COMM_SCH_TYPE BIT(1)
++#define MURU_COMM_SET (MURU_COMM_PPDU_FMT | MURU_COMM_SCH_TYPE)
++/* DL&UL User config*/
++#define MURU_USER_CNT BIT(4)
++
++enum {
++ CAPI_SU,
++ CAPI_MU,
++ CAPI_ER_SU,
++ CAPI_TB,
++ CAPI_LEGACY
++};
++
++enum {
++ CAPI_BASIC,
++ CAPI_BRP,
++ CAPI_MU_BAR,
++ CAPI_MU_RTS,
++ CAPI_BSRP,
++ CAPI_GCR_MU_BAR,
++ CAPI_BQRP,
++ CAPI_NDP_FRP
++};
++
++enum {
++ MURU_SET_BSRP_CTRL = 1,
++ MURU_SET_SUTX = 16,
++ MURU_SET_MUMIMO_CTRL = 17,
++ MURU_SET_MANUAL_CFG = 100,
++ MURU_SET_MU_DL_ACK_POLICY = 200,
++ MURU_SET_TRIG_TYPE = 201,
++ MURU_SET_20M_DYN_ALGO = 202,
++ MURU_SET_PROT_FRAME_THR = 204,
++ MURU_SET_CERT_MU_EDCA_OVERRIDE = 205,
++};
++
++enum {
++ MU_DL_ACK_POLICY_MU_BAR = 3,
++ MU_DL_ACK_POLICY_TF_FOR_ACK = 4,
++ MU_DL_ACK_POLICY_SU_BAR = 5,
++};
++
++enum {
++ BF_SOUNDING_OFF = 0,
++ BF_SOUNDING_ON,
++ BF_DATA_PACKET_APPLY,
++ BF_PFMU_MEM_ALLOCATE,
++ BF_PFMU_MEM_RELEASE,
++ BF_PFMU_TAG_READ,
++ BF_PFMU_TAG_WRITE,
++ BF_PROFILE_READ,
++ BF_PROFILE_WRITE,
++ BF_PN_READ,
++ BF_PN_WRITE,
++ BF_PFMU_MEM_ALLOC_MAP_READ,
++ BF_AID_SET,
++ BF_STA_REC_READ,
++ BF_PHASE_CALIBRATION,
++ BF_IBF_PHASE_COMP,
++ BF_LNA_GAIN_CONFIG,
++ BF_PROFILE_WRITE_20M_ALL,
++ BF_APCLIENT_CLUSTER,
++ BF_AWARE_CTRL,
++ BF_HW_ENABLE_STATUS_UPDATE,
++ BF_REPT_CLONED_STA_TO_NORMAL_STA,
++ BF_GET_QD,
++ BF_BFEE_HW_CTRL,
++ BF_PFMU_SW_TAG_WRITE,
++ BF_MOD_EN_CTRL,
++ BF_DYNSND_EN_INTR,
++ BF_DYNSND_CFG_DMCS_TH,
++ BF_DYNSND_EN_PFID_INTR,
++ BF_CONFIG,
++ BF_PFMU_DATA_WRITE,
++ BF_FBRPT_DBG_INFO_READ,
++ BF_CMD_TXSND_INFO,
++ BF_CMD_PLY_INFO,
++ BF_CMD_MU_METRIC,
++ BF_CMD_TXCMD,
++ BF_CMD_CFG_PHY,
++ BF_CMD_SND_CNT,
++ BF_CMD_MAX
++};
++
++enum {
++ BF_SND_READ_INFO = 0,
++ BF_SND_CFG_OPT,
++ BF_SND_CFG_INTV,
++ BF_SND_STA_STOP,
++ BF_SND_CFG_MAX_STA,
++ BF_SND_CFG_BFRP,
++ BF_SND_CFG_INF
++};
++
++enum {
++ MURU_UPDATE = 0,
++ MURU_DL_USER_CNT,
++ MURU_UL_USER_CNT,
++ MURU_DL_INIT,
++ MURU_UL_INIT,
++};
++#endif
+
+ #endif
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index bb21433a..e6c000a7 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -715,6 +715,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ bool pci, int *irq);
+
+ #ifdef CONFIG_MTK_VENDOR
++void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta);
++void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
++void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
++ struct ieee80211_vif *vif, struct ieee80211_sta *sta);
++int mt7915_mcu_set_rfeature_trig_type(struct mt7915_phy *phy, u8 enable, u8 trig_type);
++int mt7915_mcu_set_mu_dl_ack_policy(struct mt7915_phy *phy, u8 policy_num);
++void mt7915_mcu_set_ppdu_tx_type(struct mt7915_phy *phy, u8 ppdu_type);
++void mt7915_mcu_set_nusers_ofdma(struct mt7915_phy *phy, u8 type, u8 ofdma_user_cnt);
++void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
++void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
++int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
++void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
++void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val);
+ void mt7915_vendor_register(struct mt7915_phy *phy);
+ int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
+ u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index 176937ad..e24b4d78 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -2486,7 +2486,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
+
+ *val = dev->dbg.muru_onoff;
+
+- printk("mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
++ printk("cert mumimo dl:%d, mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
++ !!(dev->dbg.muru_onoff & MUMIMO_DL_CERT),
+ !!(dev->dbg.muru_onoff & MUMIMO_UL),
+ !!(dev->dbg.muru_onoff & MUMIMO_DL),
+ !!(dev->dbg.muru_onoff & OFDMA_UL),
+@@ -2499,8 +2500,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
+ {
+ struct mt7915_dev *dev = data;
+
+- if (val > 15) {
+- printk("Wrong value! The value is between 0 ~ 15.\n");
++ if (val > 31) {
++ printk("Wrong value! The value is between 0 ~ 31.\n");
+ goto exit;
+ }
+
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index b94d787e..7456c577 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
+ [MTK_VENDOR_ATTR_CSI_CTRL_DATA] = { .type = NLA_NESTED },
+ };
+
++static const struct nla_policy
++wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
++ [MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_WIRELESS_CTRL_OFDMA] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE] = {.type = NLA_U16 },
++ [MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
++};
++
++static const struct nla_policy
++rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
++ [MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG] = { .type = NLA_NESTED },
++ [MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF] = { .type = NLA_U8 },
++};
++
+ struct csi_null_tone {
+ u8 start;
+ u8 end;
+@@ -777,6 +800,148 @@ mt7915_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+ return len + 1;
+ }
+
++static int mt7915_vendor_rfeature_ctrl(struct wiphy *wiphy,
++ struct wireless_dev *wdev,
++ const void *data,
++ int data_len)
++{
++ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct mt7915_dev *dev = phy->dev;
++ struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL];
++ int err;
++ u32 val;
++
++ err = nla_parse(tb, MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX, data, data_len,
++ rfeature_ctrl_policy, NULL);
++ if (err)
++ return err;
++
++ val = CAPI_RFEATURE_CHANGED;
++
++ if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI]) {
++ val |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_GI)|
++ FIELD_PREP(RATE_CFG_VAL, nla_get_u8(tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI]));
++ ieee80211_iterate_stations_atomic(hw, mt7915_capi_sta_rc_work, &val);
++ ieee80211_queue_work(hw, &dev->rc_work);
++ }
++ else if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF]) {
++ val |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_HE_LTF)|
++ FIELD_PREP(RATE_CFG_VAL, nla_get_u8(tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF]));
++ ieee80211_iterate_stations_atomic(hw, mt7915_capi_sta_rc_work, &val);
++ ieee80211_queue_work(hw, &dev->rc_work);
++ }
++ else if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG]) {
++ u8 enable, trig_type;
++ int rem;
++ struct nlattr *cur;
++
++ nla_for_each_nested(cur, tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG], rem) {
++ switch(nla_type(cur)) {
++ case MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN:
++ enable = nla_get_u8(cur);
++ break;
++ case MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE:
++ trig_type = nla_get_u8(cur);
++ break;
++ default:
++ return -EINVAL;
++ };
++ }
++
++ err = mt7915_mcu_set_rfeature_trig_type(phy, enable, trig_type);
++ if (err)
++ return err;
++ }
++ else if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY]) {
++ u8 ack_policy;
++
++ ack_policy = nla_get_u8(tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY]);
++#define HE_TB_PPDU_ACK 4
++ switch (ack_policy) {
++ case HE_TB_PPDU_ACK:
++ return mt7915_mcu_set_mu_dl_ack_policy(phy, ack_policy);
++ default:
++ return 0;
++ }
++ }
++ else if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF]) {
++ u8 trig_txbf;
++
++ trig_txbf = nla_get_u8(tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF]);
++ /* CAPI only issues trig_txbf=disable */
++ }
++
++ return 0;
++}
++
++static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
++ struct wireless_dev *wdev,
++ const void *data,
++ int data_len)
++{
++ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct mt7915_dev *dev = phy->dev;
++ struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL];
++ int err;
++ u8 val8;
++ u16 val16;
++ u32 val32;
++
++ err = nla_parse(tb, MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX, data, data_len,
++ wireless_ctrl_policy, NULL);
++ if (err)
++ return err;
++
++ val32 = CAPI_WIRELESS_CHANGED;
++
++ if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS]) {
++ val32 &= ~CAPI_WIRELESS_CHANGED;
++ val32 |= CAPI_RFEATURE_CHANGED |
++ FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_MCS) |
++ FIELD_PREP(RATE_CFG_VAL, nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS]));
++ ieee80211_iterate_stations_atomic(hw, mt7915_capi_sta_rc_work, &val32);
++ ieee80211_queue_work(hw, &dev->rc_work);
++ } else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_OFDMA]) {
++ val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_OFDMA]);
++ val32 |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_OFDMA) |
++ FIELD_PREP(RATE_CFG_VAL, val8);
++ ieee80211_iterate_active_interfaces_atomic(hw, IEEE80211_IFACE_ITER_RESUME_ALL,
++ mt7915_set_wireless_vif, &val32);
++ if (val8 == 3) /* DL20and80 */
++ mt7915_mcu_set_dynalgo(phy, 1); /* Enable dynamic algo */
++ } else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE]) {
++ val16 = nla_get_u16(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE]);
++ hw->max_tx_aggregation_subframes = val16;
++ hw->max_rx_aggregation_subframes = val16;
++ } else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA]) {
++ val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA]);
++ mt7915_mcu_set_mu_edca(phy, val8);
++ } else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE]) {
++ val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE]);
++ mt7915_mcu_set_ppdu_tx_type(phy, val8);
++ } else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA]) {
++ val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA]);
++ if (FIELD_GET(OFDMA_UL, dev->dbg.muru_onoff) == 1)
++ mt7915_mcu_set_nusers_ofdma(phy, MURU_UL_USER_CNT, val8);
++ else
++ mt7915_mcu_set_nusers_ofdma(phy, MURU_DL_USER_CNT, val8);
++ } else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO]) {
++ val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO]);
++ val32 |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_MIMO) |
++ FIELD_PREP(RATE_CFG_VAL, val8);
++ ieee80211_iterate_active_interfaces_atomic(hw, IEEE80211_IFACE_ITER_RESUME_ALL,
++ mt7915_set_wireless_vif, &val32);
++ } else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]) {
++ val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]);
++ mt7915_mcu_set_cert(phy, val8); /* Cert Enable for OMI */
++ mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
++ }
++
++ return 0;
++}
++
+ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ {
+ .info = {
+@@ -801,6 +966,28 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ .dumpit = mt7915_vendor_amnt_ctrl_dump,
+ .policy = amnt_ctrl_policy,
+ .maxattr = MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
++ },
++ {
++ .info = {
++ .vendor_id = MTK_NL80211_VENDOR_ID,
++ .subcmd = MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL,
++ },
++ .flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++ WIPHY_VENDOR_CMD_NEED_RUNNING,
++ .doit = mt7915_vendor_rfeature_ctrl,
++ .policy = rfeature_ctrl_policy,
++ .maxattr = MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX,
++ },
++ {
++ .info = {
++ .vendor_id = MTK_NL80211_VENDOR_ID,
++ .subcmd = MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL,
++ },
++ .flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++ WIPHY_VENDOR_CMD_NEED_RUNNING,
++ .doit = mt7915_vendor_wireless_ctrl,
++ .policy = wireless_ctrl_policy,
++ .maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
+ }
+ };
+
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index 976817f3..1b08321c 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -6,6 +6,48 @@
+ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
+ MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
++ MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
++ MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++};
++
++enum mtk_capi_control_changed {
++ CAPI_RFEATURE_CHANGED = BIT(16),
++ CAPI_WIRELESS_CHANGED = BIT(17),
++};
++
++enum mtk_vendor_attr_wireless_ctrl {
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_OFDMA,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT = 9,
++
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA, /* reserve */
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
++};
++
++enum mtk_vendor_attr_rfeature_ctrl {
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
+ };
+
+ enum mtk_vendor_attr_csi_ctrl {
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
new file mode 100644
index 0000000..5f9e051
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -0,0 +1,37 @@
+From d29700d24b6b117341d5e3597fdf9e652e836032 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Fri, 27 May 2022 15:51:48 +0800
+Subject: [PATCH 1006/1010] mt76: mt7915:add support for runtime set in-band
+ discovery
+
+Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+---
+ mt7915/mcu.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index fe314bf2..cb6195f6 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -1977,8 +1977,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+ u8 *buf, interval;
+ int len;
+
+- if (changed & BSS_CHANGED_FILS_DISCOVERY &&
+- vif->bss_conf.fils_discovery.max_interval) {
++ if (changed & BSS_CHANGED_FILS_DISCOVERY) {
+ interval = vif->bss_conf.fils_discovery.max_interval;
+ skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
+ } else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
+@@ -2013,7 +2012,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+ discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
+ discov->tx_interval = interval;
+ discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
+- discov->enable = true;
++ discov->enable = !!(interval);
+
+ buf = (u8 *)tlv + sizeof(*discov);
+
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
new file mode 100644
index 0000000..402e888
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -0,0 +1,143 @@
+From 5aa7362344f0cd6ef9c045e0d9be98f4d679010c Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Wed, 22 Jun 2022 10:53:43 +0800
+Subject: [PATCH 1007/1010] mt76: mt7915: add mt76 vendor muru onoff command
+
+---
+ mt7915/mcu.c | 7 +++++++
+ mt7915/mcu.h | 1 +
+ mt7915/vendor.c | 43 +++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h | 12 ++++++++++++
+ 4 files changed, 63 insertions(+)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index cb6195f6..696ca11b 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -3884,6 +3884,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+ if (val == 0)
+ dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
+ break;
++ case RATE_PARAM_AUTO_HEMU:
++ if (val < 0 || val > 15) {
++ printk("Wrong value! The value is between 0-15.\n");
++ break;
++ }
++ dev->dbg.muru_onoff = val;
++ break;
+ }
+ }
+
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 6d4580bf..e7ad0560 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -415,6 +415,7 @@ enum {
+ #ifdef CONFIG_MTK_VENDOR
+ RATE_PARAM_FIXED_MIMO = 30,
+ RATE_PARAM_FIXED_OFDMA = 31,
++ RATE_PARAM_AUTO_HEMU = 32,
+ #endif
+ };
+
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index 7456c577..c7551848 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -34,6 +34,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
+ [MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
+ };
+
++static const struct nla_policy
++hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
++ [MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
++};
++
+ static const struct nla_policy
+ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
+ [MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI] = {.type = NLA_U8 },
+@@ -942,6 +947,33 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
+ return 0;
+ }
+
++static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
++ struct wireless_dev *wdev,
++ const void *data,
++ int data_len)
++{
++ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++ struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL];
++ int err;
++ u8 val8;
++ u32 val32 = 0;
++
++ err = nla_parse(tb, MTK_VENDOR_ATTR_HEMU_CTRL_MAX, data, data_len,
++ hemu_ctrl_policy, NULL);
++ if (err)
++ return err;
++
++ if (tb[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF]) {
++ val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF]);
++ val32 |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_AUTO_HEMU) |
++ FIELD_PREP(RATE_CFG_VAL, val8);
++ ieee80211_iterate_active_interfaces_atomic(hw, IEEE80211_IFACE_ITER_RESUME_ALL,
++ mt7915_set_wireless_vif, &val32);
++ }
++
++ return 0;
++}
++
+ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ {
+ .info = {
+@@ -988,6 +1020,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ .doit = mt7915_vendor_wireless_ctrl,
+ .policy = wireless_ctrl_policy,
+ .maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
++ },
++ {
++ .info = {
++ .vendor_id = MTK_NL80211_VENDOR_ID,
++ .subcmd = MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL,
++ },
++ .flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++ WIPHY_VENDOR_CMD_NEED_RUNNING,
++ .doit = mt7915_vendor_hemu_ctrl,
++ .policy = hemu_ctrl_policy,
++ .maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
+ }
+ };
+
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index 1b08321c..a8e4ebf9 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -8,6 +8,7 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
+ MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
+ MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ };
+
+ enum mtk_capi_control_changed {
+@@ -33,6 +34,17 @@ enum mtk_vendor_attr_wireless_ctrl {
+ NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
+ };
+
++enum mtk_vendor_attr_hemu_ctrl {
++ MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
++ MTK_VENDOR_ATTR_HEMU_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
++};
++
+ enum mtk_vendor_attr_rfeature_ctrl {
+ MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
+
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
new file mode 100644
index 0000000..b1c8a6f
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
@@ -0,0 +1,36 @@
+From 830e283fe7f3f7b4514fae3de01b0c728ea0ecfb Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Thu, 14 Apr 2022 15:18:02 +0800
+Subject: [PATCH 1008/1010] mt76: mt7915: drop undefined action frame
+
+---
+ mt7915/mac.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index cf119cf4..28c6ab35 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -762,6 +762,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ struct mt76_tx_info *tx_info)
+ {
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx_info->skb->data;
++ struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)tx_info->skb->data;
++ __le16 fc = hdr->frame_control;
+ struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
+ struct ieee80211_key_conf *key = info->control.hw_key;
+@@ -792,6 +794,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
+ t->skb = tx_info->skb;
+
++ if (ieee80211_is_action(fc) &&
++ mgmt->u.action.category == 0xff)
++ return -1;
++
+ id = mt76_token_consume(mdev, &t);
+ if (id < 0)
+ return id;
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
new file mode 100644
index 0000000..078dad5
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -0,0 +1,100 @@
+From e024583e77c3eedc2e3dcfb52d179a20ebb08e86 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Wed, 17 Aug 2022 13:40:24 +0800
+Subject: [PATCH 1009/1010] mt76: mt7915: add fw_version dump
+
+---
+ mt76.h | 4 ++++
+ mt76_connac_mcu.c | 9 +++++++++
+ mt7915/mtk_debugfs.c | 19 +++++++++++++++++++
+ 3 files changed, 32 insertions(+)
+
+diff --git a/mt76.h b/mt76.h
+index 33f87e51..84d49c2b 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -835,6 +835,10 @@ struct mt76_dev {
+ struct mt76_usb usb;
+ struct mt76_sdio sdio;
+ };
++
++ struct mt76_connac2_patch_hdr *patch_hdr;
++ struct mt76_connac2_fw_trailer *wm_hdr;
++ struct mt76_connac2_fw_trailer *wa_hdr;
+ };
+
+ struct mt76_power_limits {
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index c65267b4..a48903ca 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -2927,6 +2927,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+ sizeof(dev->hw->wiphy->fw_version),
+ "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
+
++ dev->wm_hdr = devm_kzalloc(dev->dev, sizeof(*hdr), GFP_KERNEL);
++ memcpy(dev->wm_hdr, hdr, sizeof(*hdr));
++
+ release_firmware(fw);
+
+ if (!fw_wa)
+@@ -2952,6 +2955,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+ goto out;
+ }
+
++ dev->wa_hdr = devm_kzalloc(dev->dev, sizeof(*hdr), GFP_KERNEL);
++ memcpy(dev->wa_hdr, hdr, sizeof(*hdr));
++
+ snprintf(dev->hw->wiphy->fw_version,
+ sizeof(dev->hw->wiphy->fw_version),
+ "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
+@@ -3022,6 +3028,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
+ dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
+ be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
+
++ dev->patch_hdr = devm_kzalloc(dev->dev, sizeof(*hdr), GFP_KERNEL);
++ memcpy(dev->patch_hdr, hdr, sizeof(*hdr));
++
+ for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
+ struct mt76_connac2_patch_sec *sec;
+ u32 len, addr, mode;
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index e24b4d78..d96f222a 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -2721,6 +2721,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
+ return 0;
+ }
+
++static int mt7915_dump_version(struct seq_file *s, void *data)
++{
++ struct mt7915_dev *dev = dev_get_drvdata(s->private);
++ struct mt76_dev *mdev = NULL;
++ seq_printf(s, "Version: 2.2.7.0\n");
++
++ if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
++ return 0;
++
++ mdev = &dev->mt76;
++ seq_printf(s, "Rom Patch Build Time: %.16s\n", mdev->patch_hdr->build_date);
++ seq_printf(s, "WM Patch Build Time: %.16s\n", mdev->wm_hdr->build_date);
++ seq_printf(s, "WA Patch Build Time: %.16s\n", mdev->wa_hdr->build_date);
++ return 0;
++}
++
+ /*usage: <en> <num> <len>
+ en: BIT(16) 0: sw amsdu 1: hw amsdu
+ num: GENMASK(15, 8) range 1-8
+@@ -2954,6 +2970,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+
+ debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
+
++ debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
++ mt7915_dump_version);
++
+ return 0;
+ }
+ #endif
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
new file mode 100644
index 0000000..50c491b
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
@@ -0,0 +1,478 @@
+From 62514b545ba99ba75fbed0ece763009b583473dc Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Mon, 6 Jun 2022 19:46:26 +0800
+Subject: [PATCH 1111/1128] mt76: mt7915: rework testmode init registers
+
+---
+ mac80211.c | 3 +-
+ mt76.h | 5 ++
+ mt76_connac_mcu.h | 1 +
+ mt7915/mcu.h | 1 +
+ mt7915/mmio.c | 2 +
+ mt7915/regs.h | 16 +++++-
+ mt7915/testmode.c | 134 +++++++++++++++++++++++++++++++++++-----------
+ mt7915/testmode.h | 28 ++++++++++
+ testmode.c | 6 ++-
+ testmode.h | 3 ++
+ 10 files changed, 164 insertions(+), 35 deletions(-)
+
+diff --git a/mac80211.c b/mac80211.c
+index acac04ef..9a908c9a 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -761,7 +761,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+ }
+
+ #ifdef CONFIG_NL80211_TESTMODE
+- if (phy->test.state == MT76_TM_STATE_RX_FRAMES) {
++ if (!(phy->test.flag & MT_TM_FW_RX_COUNT) &&
++ phy->test.state == MT76_TM_STATE_RX_FRAMES) {
+ phy->test.rx_stats.packets[q]++;
+ if (status->flag & RX_FLAG_FAILED_FCS_CRC)
+ phy->test.rx_stats.fcs_error[q]++;
+diff --git a/mt76.h b/mt76.h
+index 84d49c2b..0d87f135 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -637,6 +637,8 @@ struct mt76_testmode_ops {
+ int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
+ };
+
++#define MT_TM_FW_RX_COUNT BIT(0)
++
+ struct mt76_testmode_data {
+ enum mt76_testmode_state state;
+
+@@ -668,6 +670,8 @@ struct mt76_testmode_data {
+
+ u8 addr[3][ETH_ALEN];
+
++ u8 flag;
++
+ u32 tx_pending;
+ u32 tx_queued;
+ u16 tx_queued_limit;
+@@ -675,6 +679,7 @@ struct mt76_testmode_data {
+ struct {
+ u64 packets[__MT_RXQ_MAX];
+ u64 fcs_error[__MT_RXQ_MAX];
++ u64 len_mismatch;
+ } rx_stats;
+ };
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 0d4d466f..172a926a 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1177,6 +1177,7 @@ enum {
+ MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
+ MCU_EXT_CMD_SET_RDD_TH = 0x9d,
+ MCU_EXT_CMD_MURU_CTRL = 0x9f,
++ MCU_EXT_CMD_RX_STAT = 0xa4,
+ MCU_EXT_CMD_SET_SPR = 0xa8,
+ MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
+ MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index e7ad0560..6a145aef 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -9,6 +9,7 @@
+ enum {
+ MCU_ATE_SET_TRX = 0x1,
+ MCU_ATE_SET_FREQ_OFFSET = 0xa,
++ MCU_ATE_SET_PHY_COUNT = 0x11,
+ MCU_ATE_SET_SLOT_TIME = 0x13,
+ MCU_ATE_CLEAN_TXQUEUE = 0x1c,
+ };
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 3b4ede3b..19518cb5 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -118,6 +118,7 @@ static const u32 mt7986_reg[] = {
+ };
+
+ static const u32 mt7915_offs[] = {
++ [TMAC_TCR2] = 0x05c,
+ [TMAC_CDTR] = 0x090,
+ [TMAC_ODTR] = 0x094,
+ [TMAC_ATCR] = 0x098,
+@@ -192,6 +193,7 @@ static const u32 mt7915_offs[] = {
+ };
+
+ static const u32 mt7916_offs[] = {
++ [TMAC_TCR2] = 0x004,
+ [TMAC_CDTR] = 0x0c8,
+ [TMAC_ODTR] = 0x0cc,
+ [TMAC_ATCR] = 0x00c,
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index aca1b2f1..688f7dee 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -48,6 +48,7 @@ enum reg_rev {
+ };
+
+ enum offs_rev {
++ TMAC_TCR2,
+ TMAC_CDTR,
+ TMAC_ODTR,
+ TMAC_ATCR,
+@@ -198,6 +199,12 @@ enum offs_rev {
+ #define MT_TRB_RXPSR0_RX_WTBL_PTR GENMASK(25, 16)
+ #define MT_TRB_RXPSR0_RX_RMAC_PTR GENMASK(9, 0)
+
++#define MT_MDP_TOP_DBG_WDT_CTRL MT_MDP(0x0d0)
++#define MT_MDP_TOP_DBG_WDT_CTRL_TDP_DIS_BLK BIT(7)
++
++#define MT_MDP_TOP_DBG_CTRL MT_MDP(0x0dc)
++#define MT_MDP_TOP_DBG_CTRL_ENQ_MODE BIT(30)
++
+ /* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
+ #define MT_WF_TMAC_BASE(_band) ((_band) ? 0x820f4000 : 0x820e4000)
+ #define MT_WF_TMAC(_band, ofs) (MT_WF_TMAC_BASE(_band) + (ofs))
+@@ -206,6 +213,9 @@ enum offs_rev {
+ #define MT_TMAC_TCR0_TX_BLINK GENMASK(7, 6)
+ #define MT_TMAC_TCR0_TBTT_STOP_CTRL BIT(25)
+
++#define MT_TMAC_TCR2(_band) MT_WF_TMAC(_band, __OFFS(TMAC_TCR2))
++#define MT_TMAC_TCR2_SCH_DET_DIS BIT(19)
++
+ #define MT_TMAC_CDTR(_band) MT_WF_TMAC(_band, __OFFS(TMAC_CDTR))
+ #define MT_TMAC_ODTR(_band) MT_WF_TMAC(_band, __OFFS(TMAC_ODTR))
+ #define MT_TIMEOUT_VAL_PLCP GENMASK(15, 0)
+@@ -485,8 +495,10 @@ enum offs_rev {
+ #define MT_AGG_PCR0_VHT_PROT BIT(13)
+ #define MT_AGG_PCR0_PTA_WIN_DIS BIT(15)
+
+-#define MT_AGG_PCR1_RTS0_NUM_THRES GENMASK(31, 23)
+-#define MT_AGG_PCR1_RTS0_LEN_THRES GENMASK(19, 0)
++#define MT_AGG_PCR1_RTS0_NUM_THRES GENMASK(31, 23)
++#define MT_AGG_PCR1_RTS0_LEN_THRES GENMASK(19, 0)
++#define MT_AGG_PCR1_RTS0_NUM_THRES_MT7916 GENMASK(29, 24)
++#define MT_AGG_PCR1_RTS0_LEN_THRES_MT7916 GENMASK(22, 0)
+
+ #define MT_AGG_ACR0(_band) MT_WF_AGG(_band, __OFFS(AGG_ACR0))
+ #define MT_AGG_ACR_CFEND_RATE GENMASK(13, 0)
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 7ace05e0..931d1db2 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -30,7 +30,7 @@ struct reg_band {
+ { _list.band[0] = MT_##_reg(0, _idx); \
+ _list.band[1] = MT_##_reg(1, _idx); }
+
+-#define TM_REG_MAX_ID 17
++#define TM_REG_MAX_ID 20
+ static struct reg_band reg_backup_list[TM_REG_MAX_ID];
+
+
+@@ -133,6 +133,21 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
+ sizeof(req), false);
+ }
+
++static int
++mt7915_tm_set_phy_count(struct mt7915_phy *phy, u8 control)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct mt7915_tm_cmd req = {
++ .testmode_en = 1,
++ .param_idx = MCU_ATE_SET_PHY_COUNT,
++ .param.cfg.enable = control,
++ .param.cfg.band = phy != &dev->phy,
++ };
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
++ sizeof(req), false);
++}
++
+ static int
+ mt7915_tm_set_slot_time(struct mt7915_phy *phy, u8 slot_time, u8 sifs)
+ {
+@@ -335,7 +350,7 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+ {
+ int n_regs = ARRAY_SIZE(reg_backup_list);
+ struct mt7915_dev *dev = phy->dev;
+- u32 *b = phy->test.reg_backup;
++ u32 *b = phy->test.reg_backup, val;
+ int i;
+
+ REG_BAND_IDX(reg_backup_list[0], AGG_PCR0, 0);
+@@ -347,18 +362,28 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+ REG_BAND(reg_backup_list[6], AGG_MRCR);
+ REG_BAND(reg_backup_list[7], TMAC_TFCR0);
+ REG_BAND(reg_backup_list[8], TMAC_TCR0);
+- REG_BAND(reg_backup_list[9], AGG_ATCR1);
+- REG_BAND(reg_backup_list[10], AGG_ATCR3);
+- REG_BAND(reg_backup_list[11], TMAC_TRCR0);
+- REG_BAND(reg_backup_list[12], TMAC_ICR0);
+- REG_BAND_IDX(reg_backup_list[13], ARB_DRNGR0, 0);
+- REG_BAND_IDX(reg_backup_list[14], ARB_DRNGR0, 1);
+- REG_BAND(reg_backup_list[15], WF_RFCR);
+- REG_BAND(reg_backup_list[16], WF_RFCR1);
++ REG_BAND(reg_backup_list[9], TMAC_TCR2);
++ REG_BAND(reg_backup_list[10], AGG_ATCR1);
++ REG_BAND(reg_backup_list[11], AGG_ATCR3);
++ REG_BAND(reg_backup_list[12], TMAC_TRCR0);
++ REG_BAND(reg_backup_list[13], TMAC_ICR0);
++ REG_BAND_IDX(reg_backup_list[14], ARB_DRNGR0, 0);
++ REG_BAND_IDX(reg_backup_list[15], ARB_DRNGR0, 1);
++ REG_BAND(reg_backup_list[16], WF_RFCR);
++ REG_BAND(reg_backup_list[17], WF_RFCR1);
++
++ if (is_mt7916(&dev->mt76)) {
++ reg_backup_list[18].band[phy->band_idx] = MT_MDP_TOP_DBG_WDT_CTRL;
++ reg_backup_list[19].band[phy->band_idx] = MT_MDP_TOP_DBG_CTRL;
++ }
+
+ if (phy->mt76->test.state == MT76_TM_STATE_OFF) {
+- for (i = 0; i < n_regs; i++)
+- mt76_wr(dev, reg_backup_list[i].band[phy->band_idx], b[i]);
++ for (i = 0; i < n_regs; i++) {
++ u8 reg = reg_backup_list[i].band[phy->band_idx];
++
++ if (reg)
++ mt76_wr(dev, reg, b[i]);
++ }
+ return;
+ }
+
+@@ -378,8 +403,13 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+ MT_AGG_PCR0_BW40_PROT | MT_AGG_PCR0_BW80_PROT);
+ mt76_set(dev, MT_AGG_PCR0(phy->band_idx, 0), MT_AGG_PCR0_PTA_WIN_DIS);
+
+- mt76_wr(dev, MT_AGG_PCR0(phy->band_idx, 1), MT_AGG_PCR1_RTS0_NUM_THRES |
+- MT_AGG_PCR1_RTS0_LEN_THRES);
++ if (is_mt7915(&dev->mt76))
++ val = MT_AGG_PCR1_RTS0_NUM_THRES | MT_AGG_PCR1_RTS0_LEN_THRES;
++ else
++ val = MT_AGG_PCR1_RTS0_NUM_THRES_MT7916 |
++ MT_AGG_PCR1_RTS0_LEN_THRES_MT7916;
++
++ mt76_wr(dev, MT_AGG_PCR0(phy->band_idx, 1), val);
+
+ mt76_clear(dev, MT_AGG_MRCR(phy->band_idx), MT_AGG_MRCR_BAR_CNT_LIMIT |
+ MT_AGG_MRCR_LAST_RTS_CTS_RN | MT_AGG_MRCR_RTS_FAIL_LIMIT |
+@@ -392,10 +422,19 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+
+ mt76_wr(dev, MT_TMAC_TFCR0(phy->band_idx), 0);
+ mt76_clear(dev, MT_TMAC_TCR0(phy->band_idx), MT_TMAC_TCR0_TBTT_STOP_CTRL);
++ mt76_set(dev, MT_TMAC_TCR2(phy->band_idx), MT_TMAC_TCR2_SCH_DET_DIS);
+
+ /* config rx filter for testmode rx */
+ mt76_wr(dev, MT_WF_RFCR(phy->band_idx), 0xcf70a);
+ mt76_wr(dev, MT_WF_RFCR1(phy->band_idx), 0);
++
++ if (is_mt7916(&dev->mt76)) {
++ /* enable MDP Tx block mode */
++ mt76_clear(dev, MT_MDP_TOP_DBG_WDT_CTRL,
++ MT_MDP_TOP_DBG_WDT_CTRL_TDP_DIS_BLK);
++ mt76_clear(dev, MT_MDP_TOP_DBG_CTRL,
++ MT_MDP_TOP_DBG_CTRL_ENQ_MODE);
++ }
+ }
+
+ static void
+@@ -415,6 +454,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+ mt7915_mcu_add_bss_info(phy, phy->monitor_vif, en);
+ mt7915_mcu_add_sta(dev, phy->monitor_vif, NULL, en);
+
++ phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
++
+ if (!en)
+ mt7915_tm_set_tam_arb(phy, en, 0);
+ }
+@@ -477,18 +518,63 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ mt7915_tm_set_trx(phy, TM_MAC_TX, en);
+ }
+
++static int
++mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
++{
++#define CMD_RX_STAT_BAND 0x3
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ struct mt7915_tm_rx_stat_band *rs_band;
++ struct mt7915_dev *dev = phy->dev;
++ struct sk_buff *skb;
++ struct {
++ u8 format_id;
++ u8 band;
++ u8 _rsv[2];
++ } __packed req = {
++ .format_id = CMD_RX_STAT_BAND,
++ .band = phy != &dev->phy,
++ };
++ int ret;
++
++ ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(RX_STAT),
++ &req, sizeof(req), true, &skb);
++ if (ret)
++ return ret;
++
++ rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
++ /* pr_info("mdrdy_cnt = %d\n", le32_to_cpu(rs_band->mdrdy_cnt)); */
++ /* pr_info("fcs_err = %d\n", le16_to_cpu(rs_band->fcs_err)); */
++ /* pr_info("len_mismatch = %d\n", le16_to_cpu(rs_band->len_mismatch)); */
++ /* pr_info("fcs_ok = %d\n", le16_to_cpu(rs_band->fcs_succ)); */
++
++ if (!clear) {
++ enum mt76_rxq_id q = req.band ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
++
++ td->rx_stats.packets[q] += le32_to_cpu(rs_band->mdrdy_cnt);
++ td->rx_stats.fcs_error[q] += le16_to_cpu(rs_band->fcs_err);
++ td->rx_stats.len_mismatch += le16_to_cpu(rs_band->len_mismatch);
++ }
++
++ dev_kfree_skb(skb);
++
++ return 0;
++}
++
+ static void
+ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+ {
+ mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
+
+ if (en) {
+- struct mt7915_dev *dev = phy->dev;
+-
+ mt7915_tm_update_channel(phy);
+
+ /* read-clear */
+- mt76_rr(dev, MT_MIB_SDR3(phy->band_idx));
++ mt7915_tm_get_rx_stats(phy, true);
++
++ /* clear fw count */
++ mt7915_tm_set_phy_count(phy, 0);
++ mt7915_tm_set_phy_count(phy, 1);
++
+ mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
+ }
+ }
+@@ -718,12 +804,8 @@ static int
+ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+ {
+ struct mt7915_phy *phy = mphy->priv;
+- struct mt7915_dev *dev = phy->dev;
+- enum mt76_rxq_id q;
+ void *rx, *rssi;
+- u16 fcs_err;
+ int i;
+- u32 cnt;
+
+ rx = nla_nest_start(msg, MT76_TM_STATS_ATTR_LAST_RX);
+ if (!rx)
+@@ -767,15 +849,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+
+ nla_nest_end(msg, rx);
+
+- cnt = mt76_rr(dev, MT_MIB_SDR3(phy->band_idx));
+- fcs_err = is_mt7915(&dev->mt76) ? FIELD_GET(MT_MIB_SDR3_FCS_ERR_MASK, cnt) :
+- FIELD_GET(MT_MIB_SDR3_FCS_ERR_MASK_MT7916, cnt);
+-
+- q = phy->band_idx ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
+- mphy->test.rx_stats.packets[q] += fcs_err;
+- mphy->test.rx_stats.fcs_error[q] += fcs_err;
+-
+- return 0;
++ return mt7915_tm_get_rx_stats(phy, false);
+ }
+
+ const struct mt76_testmode_ops mt7915_testmode_ops = {
+diff --git a/mt7915/testmode.h b/mt7915/testmode.h
+index 5573ac30..a1c54c89 100644
+--- a/mt7915/testmode.h
++++ b/mt7915/testmode.h
+@@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
+ u8 rsv;
+ };
+
++struct mt7915_tm_cfg {
++ u8 enable;
++ u8 band;
++ u8 _rsv[2];
++};
++
+ struct mt7915_tm_cmd {
+ u8 testmode_en;
+ u8 param_idx;
+@@ -43,6 +49,7 @@ struct mt7915_tm_cmd {
+ struct mt7915_tm_freq_offset freq;
+ struct mt7915_tm_slot_time slot;
+ struct mt7915_tm_clean_txq clean;
++ struct mt7915_tm_cfg cfg;
+ u8 test[72];
+ } param;
+ } __packed;
+@@ -102,4 +109,25 @@ enum {
+ TAM_ARB_OP_MODE_FORCE_SU = 5,
+ };
+
++struct mt7915_tm_rx_stat_band {
++ u8 category;
++
++ /* mac */
++ __le16 fcs_err;
++ __le16 len_mismatch;
++ __le16 fcs_succ;
++ __le32 mdrdy_cnt;
++ /* phy */
++ __le16 fcs_err_cck;
++ __le16 fcs_err_ofdm;
++ __le16 pd_cck;
++ __le16 pd_ofdm;
++ __le16 sig_err_cck;
++ __le16 sfd_err_cck;
++ __le16 sig_err_ofdm;
++ __le16 tag_err_ofdm;
++ __le16 mdrdy_cnt_cck;
++ __le16 mdrdy_cnt_ofdm;
++};
++
+ #endif
+diff --git a/testmode.c b/testmode.c
+index 0accc71a..1d0d5d30 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -447,8 +447,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_LDPC], &td->tx_rate_ldpc, 0, 1) ||
+ mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_STBC], &td->tx_rate_stbc, 0, 1) ||
+ mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_LTF], &td->tx_ltf, 0, 2) ||
+- mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA],
+- &td->tx_antenna_mask, 0, 0xff) ||
++ mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA], &td->tx_antenna_mask, 1, 0xff) ||
+ mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_SPE_IDX], &td->tx_spe_idx, 0, 27) ||
+ mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
+ &td->tx_duty_cycle, 0, 99) ||
+@@ -560,6 +559,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
+ nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_PACKETS, rx_packets,
+ MT76_TM_STATS_ATTR_PAD) ||
+ nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_FCS_ERROR, rx_fcs_error,
++ MT76_TM_STATS_ATTR_PAD) ||
++ nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_LEN_MISMATCH,
++ td->rx_stats.len_mismatch,
+ MT76_TM_STATS_ATTR_PAD))
+ return -EMSGSIZE;
+
+diff --git a/testmode.h b/testmode.h
+index 5e2792d8..89613266 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -101,6 +101,8 @@ enum mt76_testmode_attr {
+ * @MT76_TM_STATS_ATTR_RX_FCS_ERROR: number of rx packets with FCS error (u64)
+ * @MT76_TM_STATS_ATTR_LAST_RX: information about the last received packet
+ * see &enum mt76_testmode_rx_attr
++ * @MT76_TM_STATS_ATTR_RX_LEN_MISMATCH: number of rx packets with length
++ * mismatch error (u64)
+ */
+ enum mt76_testmode_stats_attr {
+ MT76_TM_STATS_ATTR_UNSPEC,
+@@ -113,6 +115,7 @@ enum mt76_testmode_stats_attr {
+ MT76_TM_STATS_ATTR_RX_PACKETS,
+ MT76_TM_STATS_ATTR_RX_FCS_ERROR,
+ MT76_TM_STATS_ATTR_LAST_RX,
++ MT76_TM_STATS_ATTR_RX_LEN_MISMATCH,
+
+ /* keep last */
+ NUM_MT76_TM_STATS_ATTRS,
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
new file mode 100644
index 0000000..31cddf7
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
@@ -0,0 +1,2920 @@
+From b797f4107d893a697b20cfe77ad82a4c8348c397 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Thu, 21 Apr 2022 15:43:19 +0800
+Subject: [PATCH 1112/1128] mt76: testmode: additional supports
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ dma.c | 3 +-
+ mac80211.c | 12 +
+ mt76.h | 108 ++++-
+ mt76_connac_mcu.c | 4 +
+ mt76_connac_mcu.h | 2 +
+ mt7915/init.c | 2 +-
+ mt7915/mac.c | 37 +-
+ mt7915/main.c | 2 +-
+ mt7915/mcu.c | 10 +-
+ mt7915/mcu.h | 28 +-
+ mt7915/mmio.c | 2 +
+ mt7915/mt7915.h | 14 +-
+ mt7915/regs.h | 3 +
+ mt7915/testmode.c | 1170 ++++++++++++++++++++++++++++++++++++++++++---
+ mt7915/testmode.h | 278 +++++++++++
+ testmode.c | 275 +++++++++--
+ testmode.h | 75 +++
+ tools/fields.c | 80 ++++
+ tx.c | 3 +-
+ 19 files changed, 1962 insertions(+), 146 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index ae22b959..d2891c64 100644
+--- a/dma.c
++++ b/dma.c
+@@ -535,8 +535,7 @@ free:
+ if (mt76_is_testmode_skb(dev, skb, &hw)) {
+ struct mt76_phy *phy = hw->priv;
+
+- if (tx_info.skb == phy->test.tx_skb)
+- phy->test.tx_done--;
++ phy->test.tx_done--;
+ }
+ #endif
+
+diff --git a/mac80211.c b/mac80211.c
+index 9a908c9a..f8ca7ba1 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
+ CHAN5G(60, 5300),
+ CHAN5G(64, 5320),
+
++ CHAN5G(68, 5340),
++ CHAN5G(80, 5400),
++ CHAN5G(84, 5420),
++ CHAN5G(88, 5440),
++ CHAN5G(92, 5460),
++ CHAN5G(96, 5480),
++
+ CHAN5G(100, 5500),
+ CHAN5G(104, 5520),
+ CHAN5G(108, 5540),
+@@ -75,6 +82,11 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
+ CHAN5G(165, 5825),
+ CHAN5G(169, 5845),
+ CHAN5G(173, 5865),
++
++ CHAN5G(184, 4920),
++ CHAN5G(188, 4940),
++ CHAN5G(192, 4960),
++ CHAN5G(196, 4980),
+ };
+
+ static const struct ieee80211_channel mt76_channels_6ghz[] = {
+diff --git a/mt76.h b/mt76.h
+index 0d87f135..32e2dea0 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -635,6 +635,21 @@ struct mt76_testmode_ops {
+ int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
+ enum mt76_testmode_state new_state);
+ int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
++ int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
++};
++
++struct mt76_testmode_entry_data {
++ struct sk_buff *tx_skb;
++
++ u16 tx_mpdu_len;
++ u8 tx_rate_idx;
++ u8 tx_rate_nss;
++ u8 tx_rate_ldpc;
++
++ u8 addr[3][ETH_ALEN];
++ u8 aid;
++ u8 ru_alloc;
++ u8 ru_idx;
+ };
+
+ #define MT_TM_FW_RX_COUNT BIT(0)
+@@ -643,16 +658,11 @@ struct mt76_testmode_data {
+ enum mt76_testmode_state state;
+
+ u32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];
+- struct sk_buff *tx_skb;
+
+ u32 tx_count;
+- u16 tx_mpdu_len;
+
+ u8 tx_rate_mode;
+- u8 tx_rate_idx;
+- u8 tx_rate_nss;
+ u8 tx_rate_sgi;
+- u8 tx_rate_ldpc;
+ u8 tx_rate_stbc;
+ u8 tx_ltf;
+
+@@ -668,10 +678,37 @@ struct mt76_testmode_data {
+ u8 tx_power[4];
+ u8 tx_power_control;
+
+- u8 addr[3][ETH_ALEN];
++ struct list_head tm_entry_list;
++ struct mt76_wcid *cur_entry;
++ u8 entry_num;
++ union {
++ struct mt76_testmode_entry_data ed;
++ struct {
++ /* must be the same as mt76_testmode_entry_data */
++ struct sk_buff *tx_skb;
++
++ u16 tx_mpdu_len;
++ u8 tx_rate_idx;
++ u8 tx_rate_nss;
++ u8 tx_rate_ldpc;
++
++ u8 addr[3][ETH_ALEN];
++ u8 aid;
++ u8 ru_alloc;
++ u8 ru_idx;
++ };
++ };
+
+ u8 flag;
+
++ struct {
++ u8 type;
++ u8 enable;
++ } cfg;
++
++ u8 txbf_act;
++ u16 txbf_param[8];
++
+ u32 tx_pending;
+ u32 tx_queued;
+ u16 tx_queued_limit;
+@@ -1132,6 +1169,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+ #endif
+ }
+
++#ifdef CONFIG_NL80211_TESTMODE
++static inline struct mt76_wcid *
++mt76_testmode_first_entry(struct mt76_phy *phy)
++{
++ if (list_empty(&phy->test.tm_entry_list) && !phy->test.aid)
++ return &phy->dev->global_wcid;
++
++ return list_first_entry(&phy->test.tm_entry_list,
++ typeof(struct mt76_wcid),
++ list);
++}
++
++static inline struct mt76_testmode_entry_data *
++mt76_testmode_entry_data(struct mt76_phy *phy, struct mt76_wcid *wcid)
++{
++ if (!wcid)
++ return NULL;
++ if (wcid == &phy->dev->global_wcid)
++ return &phy->test.ed;
++
++ return (struct mt76_testmode_entry_data *)((u8 *)wcid +
++ phy->hw->sta_data_size);
++}
++
++#define mt76_tm_for_each_entry(phy, wcid, ed) \
++ for (wcid = mt76_testmode_first_entry(phy), \
++ ed = mt76_testmode_entry_data(phy, wcid); \
++ ((phy->test.aid && \
++ !list_entry_is_head(wcid, &phy->test.tm_entry_list, list)) || \
++ (!phy->test.aid && wcid == &phy->dev->global_wcid)) && ed; \
++ wcid = list_next_entry(wcid, list), \
++ ed = mt76_testmode_entry_data(phy, wcid))
++#endif
++
++static inline bool __mt76_is_testmode_skb(struct mt76_phy *phy,
++ struct sk_buff *skb)
++{
++#ifdef CONFIG_NL80211_TESTMODE
++ struct mt76_testmode_entry_data *ed = &phy->test.ed;
++ struct mt76_wcid *wcid;
++
++ if (skb == ed->tx_skb)
++ return true;
++
++ mt76_tm_for_each_entry(phy, wcid, ed)
++ if (skb == ed->tx_skb)
++ return true;
++ return false;
++#else
++ return false;
++#endif
++}
++
+ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+ struct sk_buff *skb,
+ struct ieee80211_hw **hw)
+@@ -1142,7 +1232,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+ for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
+ struct mt76_phy *phy = dev->phys[i];
+
+- if (phy && skb == phy->test.tx_skb) {
++ if (phy && mt76_testmode_enabled(phy) &&
++ __mt76_is_testmode_skb(phy, skb)) {
+ *hw = dev->phys[i]->hw;
+ return true;
+ }
+@@ -1244,7 +1335,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
+ struct netlink_callback *cb, void *data, int len);
+ int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
+-int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len);
++int mt76_testmode_init_skb(struct mt76_phy *phy, u32 len,
++ struct sk_buff **tx_skb, u8 (*addr)[ETH_ALEN]);
+
+ static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
+ {
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index a48903ca..4f17954e 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -394,6 +394,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
+ switch (vif->type) {
+ case NL80211_IFTYPE_MESH_POINT:
+ case NL80211_IFTYPE_AP:
++ case NL80211_IFTYPE_MONITOR:
+ if (vif->p2p)
+ conn_type = CONNECTION_P2P_GC;
+ else
+@@ -575,6 +576,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
+ rx->rca2 = 1;
+ rx->rv = 1;
+
++ if (vif->type == NL80211_IFTYPE_MONITOR)
++ rx->rca1 = 0;
++
+ if (!is_connac_v1(dev))
+ return;
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 172a926a..e10e92b6 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -983,6 +983,7 @@ enum {
+ MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
+ MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
+ MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
++ MCU_EXT_EVENT_BF_STATUS_READ = 0x35,
+ MCU_EXT_EVENT_RDD_REPORT = 0x3a,
+ MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
+ MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
+@@ -1184,6 +1185,7 @@ enum {
+ MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
+ /* for vendor csi and air monitor */
+ MCU_EXT_CMD_SMESH_CTRL = 0xae,
++ MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
+ MCU_EXT_CMD_CERT_CFG = 0xb7,
+ MCU_EXT_CMD_CSI_CTRL = 0xc2,
+ };
+diff --git a/mt7915/init.c b/mt7915/init.c
+index d4105835..2f3453b0 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -603,7 +603,7 @@ static void mt7915_init_work(struct work_struct *work)
+ struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
+ init_work);
+
+- mt7915_mcu_set_eeprom(dev);
++ mt7915_mcu_set_eeprom(dev, dev->flash_mode);
+ mt7915_mac_init(dev);
+ mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
+ mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 28c6ab35..3b144ad0 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -629,16 +629,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+ {
+ #ifdef CONFIG_NL80211_TESTMODE
+ struct mt76_testmode_data *td = &phy->mt76->test;
++ struct mt76_testmode_entry_data *ed;
++ struct mt76_wcid *wcid;
+ const struct ieee80211_rate *r;
+- u8 bw, mode, nss = td->tx_rate_nss;
+- u8 rate_idx = td->tx_rate_idx;
++ u8 bw, mode, nss, rate_idx, ldpc;
+ u16 rateval = 0;
+ u32 val;
+ bool cck = false;
+ int band;
+
+- if (skb != phy->mt76->test.tx_skb)
++ txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
++ txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX,
++ phy->test.spe_idx));
++
++ if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU) {
++ txwi[1] |= cpu_to_le32(BIT(18));
++ txwi[2] = 0;
++ txwi[3] &= ~cpu_to_le32(MT_TXD3_NO_ACK);
++ le32p_replace_bits(&txwi[3], 0x1f, MT_TXD3_REM_TX_COUNT);
++
+ return;
++ }
++
++ mt76_tm_for_each_entry(phy->mt76, wcid, ed)
++ if (ed->tx_skb == skb)
++ break;
++
++ if (!ed)
++ return;
++
++ nss = ed->tx_rate_nss;
++ rate_idx = ed->tx_rate_idx;
++ ldpc = ed->tx_rate_ldpc;
+
+ switch (td->tx_rate_mode) {
+ case MT76_TM_TX_MODE_HT:
+@@ -728,13 +750,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+ if (mode >= MT_PHY_TYPE_HE_SU)
+ val |= FIELD_PREP(MT_TXD6_HELTF, td->tx_ltf);
+
+- if (td->tx_rate_ldpc || (bw > 0 && mode >= MT_PHY_TYPE_HE_SU))
++ if (ldpc || (bw > 0 && mode >= MT_PHY_TYPE_HE_SU))
+ val |= MT_TXD6_LDPC;
+
+ txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
++ if (phy->test.bf_en)
++ val |= MT_TXD6_TX_IBF | MT_TXD6_TX_EBF;
++
+ txwi[6] |= cpu_to_le32(val);
+- txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX,
+- phy->test.spe_idx));
+ #endif
+ }
+
+@@ -1483,7 +1506,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
+ goto out;
+
+ /* set the necessary init items */
+- ret = mt7915_mcu_set_eeprom(dev);
++ ret = mt7915_mcu_set_eeprom(dev, dev->flash_mode);
+ if (ret)
+ goto out;
+
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 75073363..e84d6132 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -223,7 +223,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+ mvif->phy = phy;
+ mvif->mt76.band_idx = phy->band_idx;
+
+- mvif->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
++ mvif->mt76.wmm_idx = (vif->type != NL80211_IFTYPE_AP && vif->type != NL80211_IFTYPE_MONITOR);
+ if (ext_phy)
+ mvif->mt76.wmm_idx += 2;
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 696ca11b..5687e136 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -367,6 +367,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ case MCU_EXT_EVENT_BCC_NOTIFY:
+ mt7915_mcu_rx_bcc_notify(dev, skb);
+ break;
++#ifdef CONFIG_NL80211_TESTMODE
++ case MCU_EXT_EVENT_BF_STATUS_READ:
++ mt7915_tm_txbf_status_read(dev, skb);
++ break;
++#endif
+ default:
+ break;
+ }
+@@ -398,6 +403,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
+ rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
+ rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
++ rxd->ext_eid == MCU_EXT_EVENT_BF_STATUS_READ ||
+ !rxd->seq)
+ mt7915_mcu_rx_unsolicited_event(dev, skb);
+ else
+@@ -2781,14 +2787,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+ return 0;
+ }
+
+-int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
++int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
+ {
+ struct mt7915_mcu_eeprom req = {
+ .buffer_mode = EE_MODE_EFUSE,
+ .format = EE_FORMAT_WHOLE,
+ };
+
+- if (dev->flash_mode)
++ if (flash_mode)
+ return mt7915_mcu_set_eeprom_flash(dev);
+
+ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 6a145aef..4bc58c98 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -8,10 +8,15 @@
+
+ enum {
+ MCU_ATE_SET_TRX = 0x1,
++ MCU_ATE_SET_TSSI = 0x5,
++ MCU_ATE_SET_DPD = 0x6,
++ MCU_ATE_SET_RATE_POWER_OFFSET = 0x7,
++ MCU_ATE_SET_THERMAL_COMP = 0x8,
+ MCU_ATE_SET_FREQ_OFFSET = 0xa,
+ MCU_ATE_SET_PHY_COUNT = 0x11,
+ MCU_ATE_SET_SLOT_TIME = 0x13,
+ MCU_ATE_CLEAN_TXQUEUE = 0x1c,
++ MCU_ATE_SET_MU_RX_AID = 0x1e,
+ };
+
+ struct mt7915_mcu_thermal_ctrl {
+@@ -464,6 +469,12 @@ enum {
+
+ enum {
+ MT_BF_SOUNDING_ON = 1,
++ MT_BF_DATA_PACKET_APPLY = 2,
++ MT_BF_PFMU_TAG_READ = 5,
++ MT_BF_PFMU_TAG_WRITE = 6,
++ MT_BF_PHASE_CAL = 14,
++ MT_BF_IBF_PHASE_COMP = 15,
++ MT_BF_PROFILE_WRITE_ALL = 17,
+ MT_BF_TYPE_UPDATE = 20,
+ MT_BF_MODULE_UPDATE = 25
+ };
+@@ -698,10 +709,19 @@ struct mt7915_muru {
+ #define MURU_OFDMA_SCH_TYPE_UL BIT(1)
+
+ /* Common Config */
+-#define MURU_COMM_PPDU_FMT BIT(0)
+-#define MURU_COMM_SCH_TYPE BIT(1)
+-#define MURU_COMM_SET (MURU_COMM_PPDU_FMT | MURU_COMM_SCH_TYPE)
+-/* DL&UL User config*/
++/* #define MURU_COMM_PPDU_FMT BIT(0) */
++/* #define MURU_COMM_SCH_TYPE BIT(1) */
++/* #define MURU_COMM_SET (MURU_COMM_PPDU_FMT | MURU_COMM_SCH_TYPE) */
++#define MURU_COMM_PPDU_FMT BIT(0)
++#define MURU_COMM_SCH_TYPE BIT(1)
++#define MURU_COMM_BAND BIT(2)
++#define MURU_COMM_WMM BIT(3)
++#define MURU_COMM_SPE_IDX BIT(4)
++#define MURU_COMM_PROC_TYPE BIT(5)
++#define MURU_COMM_SET (MURU_COMM_PPDU_FMT | MURU_COMM_BAND | \
++ MURU_COMM_WMM | MURU_COMM_SPE_IDX)
++
++/* DL&UL User config */
+ #define MURU_USER_CNT BIT(4)
+
+ enum {
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 19518cb5..fef4b126 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -132,6 +132,7 @@ static const u32 mt7915_offs[] = {
+ [ARB_DRNGR0] = 0x194,
+ [ARB_SCR] = 0x080,
+ [RMAC_MIB_AIRTIME14] = 0x3b8,
++ [AGG_AALCR0] = 0x048,
+ [AGG_AWSCR0] = 0x05c,
+ [AGG_PCR0] = 0x06c,
+ [AGG_ACR0] = 0x084,
+@@ -207,6 +208,7 @@ static const u32 mt7916_offs[] = {
+ [ARB_DRNGR0] = 0x1e0,
+ [ARB_SCR] = 0x000,
+ [RMAC_MIB_AIRTIME14] = 0x0398,
++ [AGG_AALCR0] = 0x028,
+ [AGG_AWSCR0] = 0x030,
+ [AGG_PCR0] = 0x040,
+ [AGG_ACR0] = 0x054,
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index e6c000a7..cf7fcdfc 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -316,6 +316,9 @@ struct mt7915_phy {
+ u8 last_snr;
+
+ u8 spe_idx;
++
++ bool bf_en;
++ bool bf_ever_en;
+ } test;
+ #endif
+
+@@ -415,6 +418,14 @@ struct mt7915_dev {
+ void __iomem *dcm;
+ void __iomem *sku;
+
++#ifdef CONFIG_NL80211_TESTMODE
++ struct {
++ void *txbf_phase_cal;
++ void *txbf_pfmu_data;
++ void *txbf_pfmu_tag;
++ } test;
++#endif
++
+ #ifdef MTK_DEBUG
+ u16 wlan_idx;
+ struct {
+@@ -586,7 +597,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+ struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta,
+ void *data, u32 field);
+-int mt7915_mcu_set_eeprom(struct mt7915_dev *dev);
++int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
+ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
+ int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
+ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -623,6 +634,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
+ void mt7915_mcu_exit(struct mt7915_dev *dev);
++int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
+
+ static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
+ {
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index 688f7dee..ae4695ae 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -62,6 +62,7 @@ enum offs_rev {
+ ARB_DRNGR0,
+ ARB_SCR,
+ RMAC_MIB_AIRTIME14,
++ AGG_AALCR0,
+ AGG_AWSCR0,
+ AGG_PCR0,
+ AGG_ACR0,
+@@ -482,6 +483,8 @@ enum offs_rev {
+ #define MT_WF_AGG_BASE(_band) ((_band) ? 0x820f2000 : 0x820e2000)
+ #define MT_WF_AGG(_band, ofs) (MT_WF_AGG_BASE(_band) + (ofs))
+
++#define MT_AGG_AALCR0(_band, _n) MT_WF_AGG(_band, (__OFFS(AGG_AALCR0) + \
++ (_n) * 4))
+ #define MT_AGG_AWSCR0(_band, _n) MT_WF_AGG(_band, (__OFFS(AGG_AWSCR0) + \
+ (_n) * 4))
+ #define MT_AGG_PCR0(_band, _n) MT_WF_AGG(_band, (__OFFS(AGG_PCR0) + \
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 931d1db2..d9d43cb7 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -9,6 +9,9 @@
+ enum {
+ TM_CHANGED_TXPOWER,
+ TM_CHANGED_FREQ_OFFSET,
++ TM_CHANGED_AID,
++ TM_CHANGED_CFG,
++ TM_CHANGED_TXBF_ACT,
+
+ /* must be last */
+ NUM_TM_CHANGED
+@@ -17,6 +20,9 @@ enum {
+ static const u8 tm_change_map[] = {
+ [TM_CHANGED_TXPOWER] = MT76_TM_ATTR_TX_POWER,
+ [TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
++ [TM_CHANGED_AID] = MT76_TM_ATTR_AID,
++ [TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
++ [TM_CHANGED_TXBF_ACT] = MT76_TM_ATTR_TXBF_ACT,
+ };
+
+ struct reg_band {
+@@ -33,6 +39,38 @@ struct reg_band {
+ #define TM_REG_MAX_ID 20
+ static struct reg_band reg_backup_list[TM_REG_MAX_ID];
+
++static void mt7915_tm_update_entry(struct mt7915_phy *phy);
++
++static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
++{
++ static const u8 width_to_bw[] = {
++ [NL80211_CHAN_WIDTH_40] = TM_CBW_40MHZ,
++ [NL80211_CHAN_WIDTH_80] = TM_CBW_80MHZ,
++ [NL80211_CHAN_WIDTH_80P80] = TM_CBW_8080MHZ,
++ [NL80211_CHAN_WIDTH_160] = TM_CBW_160MHZ,
++ [NL80211_CHAN_WIDTH_5] = TM_CBW_5MHZ,
++ [NL80211_CHAN_WIDTH_10] = TM_CBW_10MHZ,
++ [NL80211_CHAN_WIDTH_20] = TM_CBW_20MHZ,
++ [NL80211_CHAN_WIDTH_20_NOHT] = TM_CBW_20MHZ,
++ };
++
++ if (width >= ARRAY_SIZE(width_to_bw))
++ return 0;
++
++ return width_to_bw[width];
++}
++
++static void
++mt7915_tm_update_channel(struct mt7915_phy *phy)
++{
++ mutex_unlock(&phy->dev->mt76.mutex);
++ mt7915_set_channel(phy);
++ mutex_lock(&phy->dev->mt76.mutex);
++
++ mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(SET_RX_PATH));
++
++ mt7915_tm_update_entry(phy);
++}
+
+ static int
+ mt7915_tm_set_tx_power(struct mt7915_phy *phy)
+@@ -119,18 +157,28 @@ mt7915_tm_set_trx(struct mt7915_phy *phy, int type, bool en)
+ }
+
+ static int
+-mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
++mt7915_tm_clean_hwq(struct mt7915_phy *phy)
+ {
++ struct mt76_testmode_entry_data *ed;
++ struct mt76_wcid *wcid;
+ struct mt7915_dev *dev = phy->dev;
+ struct mt7915_tm_cmd req = {
+ .testmode_en = 1,
+ .param_idx = MCU_ATE_CLEAN_TXQUEUE,
+- .param.clean.wcid = wcid,
+ .param.clean.band = phy->band_idx,
+ };
+
+- return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
+- sizeof(req), false);
++ mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
++ int ret;
++
++ req.param.clean.wcid = wcid->idx;
++ ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL),
++ &req, sizeof(req), false);
++ if (ret)
++ return ret;
++ }
++
++ return 0;
+ }
+
+ static int
+@@ -182,12 +230,738 @@ mt7915_tm_set_tam_arb(struct mt7915_phy *phy, bool enable, bool mu)
+ return mt7915_mcu_set_muru_ctrl(dev, MURU_SET_ARB_OP_MODE, op_mode);
+ }
+
++static int
++mt7915_tm_set_cfg(struct mt7915_phy *phy)
++{
++ static const u8 cfg_cmd[] = {
++ [MT76_TM_CFG_TSSI] = MCU_ATE_SET_TSSI,
++ [MT76_TM_CFG_DPD] = MCU_ATE_SET_DPD,
++ [MT76_TM_CFG_RATE_POWER_OFFSET] = MCU_ATE_SET_RATE_POWER_OFFSET,
++ [MT76_TM_CFG_THERMAL_COMP] = MCU_ATE_SET_THERMAL_COMP,
++ };
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ struct mt7915_dev *dev = phy->dev;
++ struct mt7915_tm_cmd req = {
++ .testmode_en = !(phy->mt76->test.state == MT76_TM_STATE_OFF),
++ .param_idx = cfg_cmd[td->cfg.type],
++ .param.cfg.enable = td->cfg.enable,
++ .param.cfg.band = phy->band_idx,
++ };
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
++ sizeof(req), false);
++}
++
++static int
++mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
++ struct ieee80211_sta *sta, u8 pfmu_idx, u8 nr,
++ u8 nc, bool ebf)
++{
++ struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++ struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
++ struct mt7915_dev *dev = phy->dev;
++ struct sk_buff *skb;
++ struct sta_rec_bf *bf;
++ struct tlv *tlv;
++ u8 ndp_rate;
++
++ if (nr == 1)
++ ndp_rate = 8;
++ else if (nr == 2)
++ ndp_rate = 16;
++ else
++ ndp_rate = 24;
++
++ skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
++ &msta->wcid);
++ if (IS_ERR(skb))
++ return PTR_ERR(skb);
++
++ tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
++ bf = (struct sta_rec_bf *)tlv;
++
++ bf->pfmu = cpu_to_le16(pfmu_idx);
++ bf->sounding_phy = 1;
++ bf->bf_cap = ebf;
++ bf->ncol = nc;
++ bf->nrow = nr;
++ bf->ndp_rate = ndp_rate;
++ bf->ibf_timeout = 0xff;
++ bf->tx_mode = MT_PHY_TYPE_HT;
++
++ if (ebf) {
++ bf->mem[0].row = 0;
++ bf->mem[1].row = 1;
++ bf->mem[2].row = 2;
++ bf->mem[3].row = 3;
++ } else {
++ bf->mem[0].row = 4;
++ bf->mem[1].row = 5;
++ bf->mem[2].row = 6;
++ bf->mem[3].row = 7;
++ }
++
++ return mt76_mcu_skb_send_msg(&dev->mt76, skb,
++ MCU_EXT_CMD(STA_REC_UPDATE), true);
++}
++
++static int
++mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
++{
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ struct mt76_testmode_entry_data *ed;
++ struct ieee80211_sband_iftype_data *sdata;
++ struct ieee80211_supported_band *sband;
++ struct ieee80211_sta *sta;
++ struct mt7915_sta *msta;
++ int tid, ret;
++
++ if (td->entry_num >= MT76_TM_MAX_ENTRY_NUM)
++ return -EINVAL;
++
++ sta = kzalloc(sizeof(*sta) + phy->mt76->hw->sta_data_size +
++ sizeof(*ed), GFP_KERNEL);
++ if (!sta)
++ return -ENOMEM;
++
++ msta = (struct mt7915_sta *)sta->drv_priv;
++ ed = mt76_testmode_entry_data(phy->mt76, &msta->wcid);
++ memcpy(ed, &td->ed, sizeof(*ed));
++
++ if (phy->mt76->chandef.chan->band == NL80211_BAND_5GHZ) {
++ sband = &phy->mt76->sband_5g.sband;
++ sdata = phy->iftype[NL80211_BAND_5GHZ];
++ } else if (phy->mt76->chandef.chan->band == NL80211_BAND_6GHZ) {
++ sband = &phy->mt76->sband_6g.sband;
++ sdata = phy->iftype[NL80211_BAND_6GHZ];
++ } else {
++ sband = &phy->mt76->sband_2g.sband;
++ sdata = phy->iftype[NL80211_BAND_2GHZ];
++ }
++
++ memcpy(sta->addr, ed->addr[0], ETH_ALEN);
++ if (phy->test.bf_en) {
++ u8 addr[ETH_ALEN] = {0x00, 0x11, 0x11, 0x11, 0x11, 0x11};
++
++ memcpy(sta->addr, addr, ETH_ALEN);
++ }
++
++ if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
++ memcpy(&sta->ht_cap, &sband->ht_cap, sizeof(sta->ht_cap));
++ if (td->tx_rate_mode >= MT76_TM_TX_MODE_VHT)
++ memcpy(&sta->vht_cap, &sband->vht_cap, sizeof(sta->vht_cap));
++ if (td->tx_rate_mode >= MT76_TM_TX_MODE_HE_SU)
++ memcpy(&sta->he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
++ sizeof(sta->he_cap));
++ sta->aid = aid;
++ sta->wme = 1;
++
++ ret = mt7915_mac_sta_add(&phy->dev->mt76, phy->monitor_vif, sta);
++ if (ret) {
++ kfree(sta);
++ return ret;
++ }
++
++ /* prevent from starting tx ba session */
++ for (tid = 0; tid < 8; tid++)
++ set_bit(tid, &msta->ampdu_state);
++
++ list_add_tail(&msta->wcid.list, &td->tm_entry_list);
++ td->entry_num++;
++
++ return 0;
++}
++
++static void
++mt7915_tm_entry_remove(struct mt7915_phy *phy, u8 aid)
++{
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ struct mt76_wcid *wcid, *tmp;
++
++ if (list_empty(&td->tm_entry_list))
++ return;
++
++ list_for_each_entry_safe(wcid, tmp, &td->tm_entry_list, list) {
++ struct mt76_testmode_entry_data *ed;
++ struct mt7915_dev *dev = phy->dev;
++ struct ieee80211_sta *sta;
++
++ ed = mt76_testmode_entry_data(phy->mt76, wcid);
++ if (aid && ed->aid != aid)
++ continue;
++
++ sta = wcid_to_sta(wcid);
++ mt7915_mac_sta_remove(&dev->mt76, phy->monitor_vif, sta);
++ mt76_wcid_mask_clear(dev->mt76.wcid_mask, wcid->idx);
++
++ list_del_init(&wcid->list);
++ kfree(sta);
++ phy->mt76->test.entry_num--;
++ }
++}
++
++static int
++mt7915_tm_set_entry(struct mt7915_phy *phy)
++{
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ struct mt76_testmode_entry_data *ed;
++ struct mt76_wcid *wcid;
++
++ if (!td->aid) {
++ if (td->state > MT76_TM_STATE_IDLE)
++ mt76_testmode_set_state(phy->mt76, MT76_TM_STATE_IDLE);
++ mt7915_tm_entry_remove(phy, td->aid);
++ return 0;
++ }
++
++ mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
++ if (ed->aid == td->aid) {
++ struct sk_buff *skb;
++
++ local_bh_disable();
++ skb = ed->tx_skb;
++ memcpy(ed, &td->ed, sizeof(*ed));
++ ed->tx_skb = skb;
++ local_bh_enable();
++
++ return 0;
++ }
++ }
++
++ return mt7915_tm_entry_add(phy, td->aid);
++}
++
++static void
++mt7915_tm_update_entry(struct mt7915_phy *phy)
++{
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ struct mt76_testmode_entry_data *ed, tmp;
++ struct mt76_wcid *wcid, *last;
++
++ if (!td->aid || phy->test.bf_en)
++ return;
++
++ memcpy(&tmp, &td->ed, sizeof(tmp));
++ last = list_last_entry(&td->tm_entry_list,
++ struct mt76_wcid, list);
++
++ mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
++ memcpy(&td->ed, ed, sizeof(td->ed));
++ mt7915_tm_entry_remove(phy, td->aid);
++ mt7915_tm_entry_add(phy, td->aid);
++ if (wcid == last)
++ break;
++ }
++
++ memcpy(&td->ed, &tmp, sizeof(td->ed));
++}
++
++static int
++mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
++{
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ struct mt7915_dev *dev = phy->dev;
++ bool enable = val[0];
++ void *phase_cal, *pfmu_data, *pfmu_tag;
++ u8 addr[ETH_ALEN] = {0x00, 0x22, 0x22, 0x22, 0x22, 0x22};
++
++ if (!enable) {
++ phy->test.bf_en = 0;
++ return 0;
++ }
++
++ if (!dev->test.txbf_phase_cal) {
++ phase_cal = devm_kzalloc(dev->mt76.dev,
++ sizeof(struct mt7915_tm_txbf_phase) *
++ MAX_PHASE_GROUP_NUM,
++ GFP_KERNEL);
++ if (!phase_cal)
++ return -ENOMEM;
++
++ dev->test.txbf_phase_cal = phase_cal;
++ }
++
++ if (!dev->test.txbf_pfmu_data) {
++ pfmu_data = devm_kzalloc(dev->mt76.dev, 512, GFP_KERNEL);
++ if (!pfmu_data)
++ return -ENOMEM;
++
++ dev->test.txbf_pfmu_data = pfmu_data;
++ }
++
++ if (!dev->test.txbf_pfmu_tag) {
++ pfmu_tag = devm_kzalloc(dev->mt76.dev,
++ sizeof(struct mt7915_tm_pfmu_tag), GFP_KERNEL);
++ if (!pfmu_tag)
++ return -ENOMEM;
++
++ dev->test.txbf_pfmu_tag = pfmu_tag;
++ }
++
++ memcpy(phy->monitor_vif->addr, addr, ETH_ALEN);
++ mt7915_mcu_add_dev_info(phy, phy->monitor_vif, true);
++
++ td->tx_rate_mode = MT76_TM_TX_MODE_HT;
++ td->tx_mpdu_len = 1024;
++ td->tx_rate_sgi = 0;
++ td->tx_ipg = 100;
++ phy->test.bf_en = 1;
++
++ return mt7915_tm_set_trx(phy, TM_MAC_TX, true);
++}
++
++static int
++mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ u8 category;
++ u8 wlan_idx_lo;
++ u8 bw;
++ u8 jp_band;
++ u8 dbdc_idx;
++ bool read_from_e2p;
++ bool disable;
++ u8 wlan_idx_hi;
++ u8 buf[40];
++ } __packed req = {
++ .category = MT_BF_IBF_PHASE_COMP,
++ .bw = val[0],
++ .jp_band = (val[2] == 1) ? 1 : 0,
++ .dbdc_idx = phy->band_idx,
++ .read_from_e2p = val[3],
++ .disable = val[4],
++ };
++ struct mt7915_tm_txbf_phase *phase =
++ (struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++
++ wait_event_timeout(dev->mt76.tx_wait, phase[val[2]].status != 0, HZ);
++ memcpy(req.buf, &phase[val[2]].phase, sizeof(req.buf));
++
++ pr_info("ibf cal process: phase comp info\n");
++ print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE, 16, 1,
++ &req, sizeof(req), 0);
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++ sizeof(req), true);
++}
++
++static int
++mt7915_tm_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ u8 format_id;
++ u8 pfmu_idx;
++ bool bfer;
++ u8 dbdc_idx;
++ } __packed req = {
++ .format_id = MT_BF_PFMU_TAG_READ,
++ .pfmu_idx = pfmu_idx,
++ .bfer = 1,
++ .dbdc_idx = phy != &dev->phy,
++ };
++ struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++
++ tag->t1.pfmu_idx = 0;
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++ sizeof(req), true);
++}
++
++static int
++mt7915_tm_txbf_profile_tag_write(struct mt7915_phy *phy, u8 pfmu_idx,
++ struct mt7915_tm_pfmu_tag *tag)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ u8 format_id;
++ u8 pfmu_idx;
++ bool bfer;
++ u8 dbdc_idx;
++ u8 buf[64];
++ } __packed req = {
++ .format_id = MT_BF_PFMU_TAG_WRITE,
++ .pfmu_idx = pfmu_idx,
++ .bfer = 1,
++ .dbdc_idx = phy != &dev->phy,
++ };
++
++ memcpy(req.buf, tag, sizeof(*tag));
++ wait_event_timeout(dev->mt76.tx_wait, tag->t1.pfmu_idx != 0, HZ);
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++ sizeof(req), false);
++}
++
++static int
++mt7915_tm_txbf_apply_tx(struct mt7915_phy *phy, u16 wlan_idx, bool ebf,
++ bool ibf, bool phase_cal)
++{
++#define to_wcid_lo(id) FIELD_GET(GENMASK(7, 0), (u16)id)
++#define to_wcid_hi(id) FIELD_GET(GENMASK(9, 8), (u16)id)
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ u8 category;
++ u8 wlan_idx_lo;
++ bool ebf;
++ bool ibf;
++ bool mu_txbf;
++ bool phase_cal;
++ u8 wlan_idx_hi;
++ u8 _rsv;
++ } __packed req = {
++ .category = MT_BF_DATA_PACKET_APPLY,
++ .wlan_idx_lo = to_wcid_lo(wlan_idx),
++ .ebf = ebf,
++ .ibf = ibf,
++ .phase_cal = phase_cal,
++ .wlan_idx_hi = to_wcid_hi(wlan_idx),
++ };
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++ sizeof(req), false);
++}
++
++static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy,
++ struct mt76_wcid *wcid)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct mt76_testmode_entry_data *ed = mt76_testmode_entry_data(phy->mt76, wcid);
++ struct ieee80211_sta *sta = wcid_to_sta(wcid);
++ struct sta_phy rate = {};
++
++ if (!sta)
++ return 0;
++
++ rate.type = MT_PHY_TYPE_HT;
++ rate.bw = mt7915_tm_chan_bw(phy->mt76->chandef.width);
++ rate.nss = ed->tx_rate_nss;
++ rate.mcs = ed->tx_rate_idx;
++ rate.ldpc = (rate.bw || ed->tx_rate_ldpc) * GENMASK(2, 0);
++
++ return mt7915_mcu_set_fixed_rate_ctrl(dev, phy->monitor_vif, sta,
++ &rate, RATE_PARAM_FIXED);
++}
++
++static int
++mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
++{
++ bool bf_on = val[0], update = val[3];
++ /* u16 wlan_idx = val[2]; */
++ struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ struct mt76_wcid *wcid;
++
++ if (bf_on) {
++ mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
++ mt7915_tm_txbf_profile_tag_read(phy, 2);
++ tag->t1.invalid_prof = false;
++ mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
++
++ phy->test.bf_ever_en = true;
++
++ if (update)
++ mt7915_tm_txbf_apply_tx(phy, 1, 0, 1, 1);
++ } else {
++ if (!phy->test.bf_ever_en) {
++ if (update)
++ mt7915_tm_txbf_apply_tx(phy, 1, 0, 0, 0);
++ } else {
++ phy->test.bf_ever_en = false;
++
++ mt7915_tm_txbf_profile_tag_read(phy, 2);
++ tag->t1.invalid_prof = true;
++ mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
++ }
++ }
++
++ wcid = list_first_entry(&td->tm_entry_list, struct mt76_wcid, list);
++ mt7915_tm_txbf_set_rate(phy, wcid);
++
++ return 0;
++}
++
++static int
++mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
++{
++ static const u8 mode_to_lm[] = {
++ [MT76_TM_TX_MODE_CCK] = 0,
++ [MT76_TM_TX_MODE_OFDM] = 0,
++ [MT76_TM_TX_MODE_HT] = 1,
++ [MT76_TM_TX_MODE_VHT] = 2,
++ [MT76_TM_TX_MODE_HE_SU] = 3,
++ [MT76_TM_TX_MODE_HE_EXT_SU] = 3,
++ [MT76_TM_TX_MODE_HE_TB] = 3,
++ [MT76_TM_TX_MODE_HE_MU] = 3,
++ };
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ struct mt76_wcid *wcid;
++ struct ieee80211_vif *vif = phy->monitor_vif;
++ struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++ u8 pfmu_idx = val[0], nc = val[2], nr;
++ int ret;
++
++ if (td->tx_antenna_mask == 3)
++ nr = 1;
++ else if (td->tx_antenna_mask == 7)
++ nr = 2;
++ else
++ nr = 3;
++
++ memset(tag, 0, sizeof(*tag));
++ tag->t1.pfmu_idx = pfmu_idx;
++ tag->t1.ebf = ebf;
++ tag->t1.nr = nr;
++ tag->t1.nc = nc;
++ tag->t1.invalid_prof = true;
++
++ tag->t1.snr_sts4 = 0xc0;
++ tag->t1.snr_sts5 = 0xff;
++ tag->t1.snr_sts6 = 0xff;
++ tag->t1.snr_sts7 = 0xff;
++
++ if (ebf) {
++ tag->t1.row_id1 = 0;
++ tag->t1.row_id2 = 1;
++ tag->t1.row_id3 = 2;
++ tag->t1.row_id4 = 3;
++ tag->t1.lm = mode_to_lm[MT76_TM_TX_MODE_HT];
++ } else {
++ tag->t1.row_id1 = 4;
++ tag->t1.row_id2 = 5;
++ tag->t1.row_id3 = 6;
++ tag->t1.row_id4 = 7;
++ tag->t1.lm = mode_to_lm[MT76_TM_TX_MODE_OFDM];
++
++ tag->t2.ibf_timeout = 0xff;
++ tag->t2.ibf_nr = nr;
++ }
++
++ ret = mt7915_tm_txbf_profile_tag_write(phy, pfmu_idx, tag);
++ if (ret)
++ return ret;
++
++ wcid = list_first_entry(&td->tm_entry_list, struct mt76_wcid, list);
++ ret = mt7915_tm_add_txbf(phy, vif, wcid_to_sta(wcid), pfmu_idx, nr, nc, ebf);
++ if (ret)
++ return ret;
++
++ if (!ebf)
++ return mt7915_tm_txbf_apply_tx(phy, 1, false, true, true);
++
++ return 0;
++}
++
++static int
++mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
++{
++#define GROUP_L 0
++#define GROUP_M 1
++#define GROUP_H 2
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ u8 category;
++ u8 group_l_m_n;
++ u8 group;
++ bool sx2;
++ u8 cal_type;
++ u8 lna_gain_level;
++ u8 _rsv[2];
++ } __packed req = {
++ .category = MT_BF_PHASE_CAL,
++ .group = val[0],
++ .group_l_m_n = val[1],
++ .sx2 = val[2],
++ .cal_type = val[3],
++ .lna_gain_level = 0, /* for test purpose */
++ };
++ struct mt7915_tm_txbf_phase *phase =
++ (struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++
++ phase[req.group].status = 0;
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++ sizeof(req), true);
++}
++
++int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
++{
++#define BF_PFMU_TAG 16
++#define BF_CAL_PHASE 21
++ u8 format_id;
++
++ skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
++ format_id = *(u8 *)skb->data;
++
++ if (format_id == BF_PFMU_TAG) {
++ struct mt7915_tm_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
++
++ skb_pull(skb, 8);
++ memcpy(tag, skb->data, sizeof(struct mt7915_tm_pfmu_tag));
++ } else if (format_id == BF_CAL_PHASE) {
++ struct mt7915_tm_ibf_cal_info *cal;
++ struct mt7915_tm_txbf_phase *phase =
++ (struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++
++ cal = (struct mt7915_tm_ibf_cal_info *)skb->data;
++ switch (cal->cal_type) {
++ case IBF_PHASE_CAL_NORMAL:
++ case IBF_PHASE_CAL_NORMAL_INSTRUMENT:
++ if (cal->group_l_m_n != GROUP_M)
++ break;
++ phase = &phase[cal->group];
++ memcpy(&phase->phase, cal->buf + 16, sizeof(phase->phase));
++ phase->status = cal->status;
++ break;
++ case IBF_PHASE_CAL_VERIFY:
++ case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
++ break;
++ default:
++ break;
++ }
++ }
++
++ wake_up(&dev->mt76.tx_wait);
++
++ return 0;
++}
++
++static int
++mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
++{
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ u16 pfmu_idx = val[0];
++ u16 subc_id = val[1];
++ u16 angle11 = val[2];
++ u16 angle21 = val[3];
++ u16 angle31 = val[4];
++ u16 angle41 = val[5];
++ s16 phi11 = 0, phi21 = 0, phi31 = 0;
++ struct mt7915_tm_pfmu_data *pfmu_data;
++
++ if (subc_id > 63)
++ return -EINVAL;
++
++ if (td->tx_antenna_mask == 2) {
++ phi11 = (s16)(angle21 - angle11);
++ } else if (td->tx_antenna_mask == 3) {
++ phi11 = (s16)(angle31 - angle11);
++ phi21 = (s16)(angle31 - angle21);
++ } else {
++ phi11 = (s16)(angle41 - angle11);
++ phi21 = (s16)(angle41 - angle21);
++ phi31 = (s16)(angle41 - angle31);
++ }
++
++ pfmu_data = (struct mt7915_tm_pfmu_data *)phy->dev->test.txbf_pfmu_data;
++ pfmu_data = &pfmu_data[subc_id];
++
++ if (subc_id < 32)
++ pfmu_data->subc_idx = cpu_to_le16(subc_id + 224);
++ else
++ pfmu_data->subc_idx = cpu_to_le16(subc_id - 32);
++ pfmu_data->phi11 = cpu_to_le16(phi11);
++ pfmu_data->phi21 = cpu_to_le16(phi21);
++ pfmu_data->phi31 = cpu_to_le16(phi31);
++
++ if (subc_id == 63) {
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ u8 format_id;
++ u8 pfmu_idx;
++ u8 dbdc_idx;
++ u8 _rsv;
++ u8 buf[512];
++ } __packed req = {
++ .format_id = MT_BF_PROFILE_WRITE_ALL,
++ .pfmu_idx = pfmu_idx,
++ .dbdc_idx = phy != &dev->phy,
++ };
++
++ memcpy(req.buf, dev->test.txbf_pfmu_data, 512);
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
++ &req, sizeof(req), true);
++ }
++
++ return 0;
++}
++
++static int
++mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
++{
++ struct mt7915_tm_txbf_phase *phase, *p;
++ struct mt7915_dev *dev = phy->dev;
++ u8 *eeprom = dev->mt76.eeprom.data;
++ u16 offset;
++ bool is_7976;
++ int i;
++
++ is_7976 = mt7915_check_adie(dev, false) || is_mt7916(&dev->mt76);
++ offset = is_7976 ? 0x60a : 0x651;
++
++ phase = (struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++ for (i = 0; i < MAX_PHASE_GROUP_NUM; i++) {
++ p = &phase[i];
++
++ if (!p->status)
++ continue;
++
++ /* copy phase cal data to eeprom */
++ memcpy(eeprom + offset + i * sizeof(p->phase), &p->phase,
++ sizeof(p->phase));
++ }
++
++ return 0;
++}
++
++static int
++mt7915_tm_set_txbf(struct mt7915_phy *phy)
++{
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ u16 *val = td->txbf_param;
++
++ pr_info("ibf cal process: act = %u, val = %u, %u, %u, %u, %u\n",
++ td->txbf_act, val[0], val[1], val[2], val[3], val[4]);
++
++ switch (td->txbf_act) {
++ case MT76_TM_TXBF_ACT_INIT:
++ return mt7915_tm_txbf_init(phy, val);
++ case MT76_TM_TXBF_ACT_UPDATE_CH:
++ mt7915_tm_update_channel(phy);
++ break;
++ case MT76_TM_TXBF_ACT_PHASE_COMP:
++ return mt7915_tm_txbf_phase_comp(phy, val);
++ case MT76_TM_TXBF_ACT_TX_PREP:
++ return mt7915_tm_txbf_set_tx(phy, val);
++ case MT76_TM_TXBF_ACT_IBF_PROF_UPDATE:
++ return mt7915_tm_txbf_profile_update(phy, val, false);
++ case MT76_TM_TXBF_ACT_EBF_PROF_UPDATE:
++ return mt7915_tm_txbf_profile_update(phy, val, true);
++ case MT76_TM_TXBF_ACT_PHASE_CAL:
++ return mt7915_tm_txbf_phase_cal(phy, val);
++ case MT76_TM_TXBF_ACT_PROF_UPDATE_ALL:
++ return mt7915_tm_txbf_profile_update_all(phy, val);
++ case MT76_TM_TXBF_ACT_E2P_UPDATE:
++ return mt7915_tm_txbf_e2p_update(phy);
++ default:
++ break;
++ };
++
++ return 0;
++}
++
+ static int
+ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+- u16 cw_max, u16 txop)
++ u16 cw_max, u16 txop, u8 tx_cmd)
+ {
+ struct mt7915_vif *mvif = (struct mt7915_vif *)phy->monitor_vif->drv_priv;
+- struct mt7915_mcu_tx req = { .total = 1 };
++ struct mt7915_mcu_tx req = {
++ .valid = true,
++ .mode = tx_cmd,
++ .total = 1,
++ };
+ struct edca *e = &req.edca[0];
+
+ e->queue = qid + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
+@@ -262,7 +1036,8 @@ done:
+
+ return mt7915_tm_set_wmm_qid(phy,
+ mt76_connac_lmac_mapping(IEEE80211_AC_BE),
+- aifsn, cw, cw, 0);
++ aifsn, cw, cw, 0,
++ mode == MT76_TM_TX_MODE_HE_MU);
+ }
+
+ static int
+@@ -338,7 +1113,7 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
+ bitrate = cfg80211_calculate_bitrate(&rate);
+ tx_len = bitrate * tx_time / 10 / 8;
+
+- ret = mt76_testmode_alloc_skb(phy->mt76, tx_len);
++ ret = mt76_testmode_init_skb(phy->mt76, tx_len, &td->tx_skb, td->addr);
+ if (ret)
+ return ret;
+
+@@ -456,64 +1231,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+
+ phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
+
+- if (!en)
++ if (!en) {
+ mt7915_tm_set_tam_arb(phy, en, 0);
++
++ phy->mt76->test.aid = 0;
++ phy->mt76->test.tx_mpdu_len = 0;
++ phy->test.bf_en = 0;
++ mt7915_tm_set_entry(phy);
++ }
++}
++
++static bool
++mt7915_tm_check_skb(struct mt7915_phy *phy)
++{
++ struct mt76_testmode_entry_data *ed;
++ struct mt76_wcid *wcid;
++
++ mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
++ struct ieee80211_tx_info *info;
++
++ if (!ed->tx_skb)
++ return false;
++
++ info = IEEE80211_SKB_CB(ed->tx_skb);
++ info->control.vif = phy->monitor_vif;
++ }
++
++ return true;
++}
++
++static int
++mt7915_tm_set_ba(struct mt7915_phy *phy)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ struct mt76_wcid *wcid;
++ struct ieee80211_vif *vif = phy->monitor_vif;
++ struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++ struct ieee80211_ampdu_params params = { .buf_size = 256 };
++
++ list_for_each_entry(wcid, &td->tm_entry_list, list) {
++ int tid, ret;
++
++ params.sta = wcid_to_sta(wcid);
++ for (tid = 0; tid < 8; tid++) {
++ params.tid = tid;
++ ret = mt7915_mcu_add_tx_ba(phy->dev, ¶ms, true);
++ if (ret)
++ return ret;
++ }
++ }
++
++ mt76_wr(dev, MT_AGG_AALCR0(mvif->mt76.band_idx, mvif->mt76.wmm_idx),
++ 0x01010101);
++
++ return 0;
++}
++
++static int
++mt7915_tm_set_muru_cfg(struct mt7915_phy *phy, struct mt7915_tm_muru *muru)
++{
++/* #define MURU_SET_MANUAL_CFG 100 */
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ __le32 cmd;
++ struct mt7915_tm_muru muru;
++ } __packed req = {
++ .cmd = cpu_to_le32(MURU_SET_MANUAL_CFG),
++ };
++
++ memcpy(&req.muru, muru, sizeof(struct mt7915_tm_muru));
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++ sizeof(req), false);
++}
++
++static int
++mt7915_tm_set_muru_dl(struct mt7915_phy *phy)
++{
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ struct mt76_testmode_entry_data *ed;
++ struct mt76_wcid *wcid;
++ struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
++ struct ieee80211_vif *vif = phy->monitor_vif;
++ struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++ struct mt7915_tm_muru muru = {};
++ struct mt7915_tm_muru_comm *comm = &muru.comm;
++ struct mt7915_tm_muru_dl *dl = &muru.dl;
++ int i;
++
++ comm->ppdu_format = MURU_PPDU_HE_MU;
++ comm->band = mvif->mt76.band_idx;
++ comm->wmm_idx = mvif->mt76.wmm_idx;
++ comm->spe_idx = phy->test.spe_idx;
++
++ dl->bw = mt7915_tm_chan_bw(chandef->width);
++ dl->gi = td->tx_rate_sgi;;
++ dl->ltf = td->tx_ltf;
++ dl->tx_mode = MT_PHY_TYPE_HE_MU;
++
++ for (i = 0; i < sizeof(dl->ru); i++)
++ dl->ru[i] = 0x71;
++
++ mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
++ struct mt7915_tm_muru_dl_usr *dl_usr = &dl->usr[dl->user_num];
++
++ dl_usr->wlan_idx = cpu_to_le16(wcid->idx);
++ dl_usr->ru_alloc_seg = ed->aid < 8 ? 0 : 1;
++ dl_usr->ru_idx = ed->ru_idx;
++ dl_usr->mcs = ed->tx_rate_idx;
++ dl_usr->nss = ed->tx_rate_nss - 1;
++ dl_usr->ldpc = ed->tx_rate_ldpc;
++ dl->ru[dl->user_num] = ed->ru_alloc;
++
++ dl->user_num++;
++ }
++
++ muru.cfg_comm = cpu_to_le32(MURU_COMM_SET);
++ muru.cfg_dl = cpu_to_le32(MURU_DL_SET);
++
++ return mt7915_tm_set_muru_cfg(phy, &muru);
++}
++
++static int
++mt7915_tm_set_muru_pkt_cnt(struct mt7915_phy *phy, bool enable, u32 tx_count)
++{
++#define MURU_SET_TX_PKT_CNT 105
++#define MURU_SET_TX_EN 106
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ __le32 cmd;
++ u8 band;
++ u8 enable;
++ u8 _rsv[2];
++ __le32 tx_count;
++ } __packed req = {
++ .band = phy != &dev->phy,
++ .enable = enable,
++ .tx_count = enable ? cpu_to_le32(tx_count) : 0,
++ };
++ int ret;
++
++ req.cmd = enable ? cpu_to_le32(MURU_SET_TX_PKT_CNT) :
++ cpu_to_le32(MURU_SET_TX_EN);
++
++ ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++ sizeof(req), false);
++ if (ret)
++ return ret;
++
++ req.cmd = enable ? cpu_to_le32(MURU_SET_TX_EN) :
++ cpu_to_le32(MURU_SET_TX_PKT_CNT);
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++ sizeof(req), false);
+ }
+
+ static void
+-mt7915_tm_update_channel(struct mt7915_phy *phy)
++mt7915_tm_tx_frames_mu(struct mt7915_phy *phy, bool enable)
+ {
+- mutex_unlock(&phy->dev->mt76.mutex);
+- mt7915_set_channel(phy);
+- mutex_lock(&phy->dev->mt76.mutex);
++ struct mt76_testmode_data *td = &phy->mt76->test;
+
+- mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(SET_RX_PATH));
++ if (enable) {
++ struct mt7915_dev *dev = phy->dev;
++
++ mt7915_tm_set_ba(phy);
++ mt7915_tm_set_muru_dl(phy);
++ mt76_rr(dev, MT_MIB_DR8(phy != &dev->phy));
++ } else {
++ /* set to zero for counting real tx free num */
++ td->tx_done = 0;
++ }
++
++ mt7915_tm_set_muru_pkt_cnt(phy, enable, td->tx_count);
++ usleep_range(100000, 200000);
+ }
+
+ static void
+ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ {
+ struct mt76_testmode_data *td = &phy->mt76->test;
+- struct mt7915_dev *dev = phy->dev;
+- struct ieee80211_tx_info *info;
+- u8 duty_cycle = td->tx_duty_cycle;
+- u32 tx_time = td->tx_time;
+- u32 ipg = td->tx_ipg;
+
+ mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
+- mt7915_tm_clean_hwq(phy, dev->mt76.global_wcid.idx);
++ mt7915_tm_set_trx(phy, TM_MAC_TX, false);
+
+ if (en) {
+- mt7915_tm_update_channel(phy);
++ u32 tx_time = td->tx_time, ipg = td->tx_ipg;
++ u8 duty_cycle = td->tx_duty_cycle;
++
++ if (!phy->test.bf_en)
++ mt7915_tm_update_channel(phy);
+
+ if (td->tx_spe_idx)
+ phy->test.spe_idx = td->tx_spe_idx;
+ else
+ phy->test.spe_idx = mt76_connac_spe_idx(td->tx_antenna_mask);
+- }
+
+- mt7915_tm_set_tam_arb(phy, en,
+- td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU);
++ /* if all three params are set, duty_cycle will be ignored */
++ if (duty_cycle && tx_time && !ipg) {
++ ipg = tx_time * 100 / duty_cycle - tx_time;
++ } else if (duty_cycle && !tx_time && ipg) {
++ if (duty_cycle < 100)
++ tx_time = duty_cycle * ipg / (100 - duty_cycle);
++ }
+
+- /* if all three params are set, duty_cycle will be ignored */
+- if (duty_cycle && tx_time && !ipg) {
+- ipg = tx_time * 100 / duty_cycle - tx_time;
+- } else if (duty_cycle && !tx_time && ipg) {
+- if (duty_cycle < 100)
+- tx_time = duty_cycle * ipg / (100 - duty_cycle);
+- }
++ mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
++ mt7915_tm_set_tx_len(phy, tx_time);
+
+- mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
+- mt7915_tm_set_tx_len(phy, tx_time);
++ if (ipg)
++ td->tx_queued_limit = MT76_TM_TIMEOUT * 1000000 / ipg / 2;
+
+- if (ipg)
+- td->tx_queued_limit = MT76_TM_TIMEOUT * 1000000 / ipg / 2;
++ if (!mt7915_tm_check_skb(phy))
++ return;
++ } else {
++ mt7915_tm_clean_hwq(phy);
++ }
+
+- if (!en || !td->tx_skb)
+- return;
++ mt7915_tm_set_tam_arb(phy, en,
++ td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU);
+
+- info = IEEE80211_SKB_CB(td->tx_skb);
+- info->control.vif = phy->monitor_vif;
++ if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
++ mt7915_tm_tx_frames_mu(phy, en);
+
+ mt7915_tm_set_trx(phy, TM_MAC_TX, en);
+ }
+@@ -542,10 +1480,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+ return ret;
+
+ rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
+- /* pr_info("mdrdy_cnt = %d\n", le32_to_cpu(rs_band->mdrdy_cnt)); */
+- /* pr_info("fcs_err = %d\n", le16_to_cpu(rs_band->fcs_err)); */
+- /* pr_info("len_mismatch = %d\n", le16_to_cpu(rs_band->len_mismatch)); */
+- /* pr_info("fcs_ok = %d\n", le16_to_cpu(rs_band->fcs_succ)); */
+
+ if (!clear) {
+ enum mt76_rxq_id q = req.band ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
+@@ -560,13 +1494,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+ return 0;
+ }
+
++static int
++mt7915_tm_set_rx_user_idx(struct mt7915_phy *phy, u8 aid)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct mt76_wcid *wcid = NULL;
++ struct mt76_testmode_entry_data *ed;
++ struct {
++ u8 band;
++ u8 _rsv;
++ __le16 wlan_idx;
++ } __packed req = {
++ .band = phy->band_idx,
++ };
++
++ mt76_tm_for_each_entry(phy->mt76, wcid, ed)
++ if (ed->aid == aid)
++ break;
++
++ if (!wcid)
++ return -EINVAL;
++
++ req.wlan_idx = cpu_to_le16(wcid->idx);
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_STAT_USER_CTRL),
++ &req, sizeof(req), false);
++}
++
++static int
++mt7915_tm_set_muru_aid(struct mt7915_phy *phy, u16 aid)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct mt7915_tm_cmd req = {
++ .testmode_en = 1,
++ .param_idx = MCU_ATE_SET_MU_RX_AID,
++ .param.rx_aid.band = cpu_to_le32(phy->band_idx),
++ .param.rx_aid.aid = cpu_to_le16(aid),
++ };
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
++ sizeof(req), false);
++}
++
+ static void
+ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+ {
++ struct mt76_testmode_data *td = &phy->mt76->test;
++
++ mt7915_tm_set_trx(phy, TM_MAC_TX, false);
+ mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
+
+ if (en) {
+- mt7915_tm_update_channel(phy);
++ if (!phy->test.bf_en)
++ mt7915_tm_update_channel(phy);
++ if (td->aid)
++ mt7915_tm_set_rx_user_idx(phy, td->aid);
+
+ /* read-clear */
+ mt7915_tm_get_rx_stats(phy, true);
+@@ -574,9 +1556,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+ /* clear fw count */
+ mt7915_tm_set_phy_count(phy, 0);
+ mt7915_tm_set_phy_count(phy, 1);
+-
+- mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
+ }
++
++ if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
++ mt7915_tm_set_muru_aid(phy, en ? td->aid : 0xf800);
++
++ mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
+ }
+
+ static int
+@@ -614,34 +1599,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+ tx_cont->tx_ant = td->tx_antenna_mask;
+ tx_cont->band = phy->band_idx;
+
+- switch (chandef->width) {
+- case NL80211_CHAN_WIDTH_40:
+- tx_cont->bw = CMD_CBW_40MHZ;
+- break;
+- case NL80211_CHAN_WIDTH_80:
+- tx_cont->bw = CMD_CBW_80MHZ;
+- break;
+- case NL80211_CHAN_WIDTH_80P80:
+- tx_cont->bw = CMD_CBW_8080MHZ;
+- break;
+- case NL80211_CHAN_WIDTH_160:
+- tx_cont->bw = CMD_CBW_160MHZ;
+- break;
+- case NL80211_CHAN_WIDTH_5:
+- tx_cont->bw = CMD_CBW_5MHZ;
+- break;
+- case NL80211_CHAN_WIDTH_10:
+- tx_cont->bw = CMD_CBW_10MHZ;
+- break;
+- case NL80211_CHAN_WIDTH_20:
+- tx_cont->bw = CMD_CBW_20MHZ;
+- break;
+- case NL80211_CHAN_WIDTH_20_NOHT:
+- tx_cont->bw = CMD_CBW_20MHZ;
+- break;
+- default:
+- return -EINVAL;
+- }
++ tx_cont->bw = mt7915_tm_chan_bw(chandef->width);
+
+ if (!en) {
+ req.op.rf.param.func_data = cpu_to_le32(phy->band_idx);
+@@ -725,6 +1683,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+ mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
+ if (changed & BIT(TM_CHANGED_TXPOWER))
+ mt7915_tm_set_tx_power(phy);
++ if (changed & BIT(TM_CHANGED_AID))
++ mt7915_tm_set_entry(phy);
++ if (changed & BIT(TM_CHANGED_CFG))
++ mt7915_tm_set_cfg(phy);
++ if (changed & BIT(TM_CHANGED_TXBF_ACT))
++ mt7915_tm_set_txbf(phy);
+ }
+
+ static int
+@@ -804,6 +1768,7 @@ static int
+ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+ {
+ struct mt7915_phy *phy = mphy->priv;
++ struct mt7915_dev *dev = phy->dev;
+ void *rx, *rssi;
+ int i;
+
+@@ -849,11 +1814,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+
+ nla_nest_end(msg, rx);
+
++ if (mphy->test.tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
++ mphy->test.tx_done += mt76_rr(dev, MT_MIB_DR8(phy != &dev->phy));
++
+ return mt7915_tm_get_rx_stats(phy, false);
+ }
+
++static int
++mt7915_tm_write_back_to_efuse(struct mt7915_dev *dev)
++{
++ struct mt7915_mcu_eeprom_info req = {};
++ u8 *eeprom = dev->mt76.eeprom.data;
++ int i, ret = -EINVAL;
++
++ /* prevent from damaging chip id in efuse */
++ if (mt76_chip(&dev->mt76) != get_unaligned_le16(eeprom))
++ goto out;
++
++ for (i = 0; i < mt7915_eeprom_size(dev); i += MT76_TM_EEPROM_BLOCK_SIZE) {
++ req.addr = cpu_to_le32(i);
++ memcpy(&req.data, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
++
++ ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_ACCESS),
++ &req, sizeof(req), true);
++ if (ret)
++ return ret;
++ }
++
++out:
++ return ret;
++}
++
++static int
++mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
++{
++ struct mt7915_phy *phy = mphy->priv;
++ struct mt7915_dev *dev = phy->dev;
++ u8 *eeprom = dev->mt76.eeprom.data;
++ int ret = 0;
++
++ if (offset >= mt7915_eeprom_size(dev))
++ return -EINVAL;
++
++ switch (action) {
++ case MT76_TM_EEPROM_ACTION_UPDATE_DATA:
++ memcpy(eeprom + offset, val, MT76_TM_EEPROM_BLOCK_SIZE);
++ break;
++ case MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE:
++ ret = mt7915_mcu_set_eeprom(dev, true);
++ break;
++ case MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE:
++ ret = mt7915_tm_write_back_to_efuse(dev);
++ break;
++ default:
++ break;
++ }
++
++ return ret;
++}
++
+ const struct mt76_testmode_ops mt7915_testmode_ops = {
+ .set_state = mt7915_tm_set_state,
+ .set_params = mt7915_tm_set_params,
+ .dump_stats = mt7915_tm_dump_stats,
++ .set_eeprom = mt7915_tm_set_eeprom,
+ };
+diff --git a/mt7915/testmode.h b/mt7915/testmode.h
+index a1c54c89..01b08e9e 100644
+--- a/mt7915/testmode.h
++++ b/mt7915/testmode.h
+@@ -4,6 +4,8 @@
+ #ifndef __MT7915_TESTMODE_H
+ #define __MT7915_TESTMODE_H
+
++#include "mcu.h"
++
+ struct mt7915_tm_trx {
+ u8 type;
+ u8 enable;
+@@ -39,6 +41,11 @@ struct mt7915_tm_cfg {
+ u8 _rsv[2];
+ };
+
++struct mt7915_tm_mu_rx_aid {
++ __le32 band;
++ __le16 aid;
++};
++
+ struct mt7915_tm_cmd {
+ u8 testmode_en;
+ u8 param_idx;
+@@ -50,6 +57,7 @@ struct mt7915_tm_cmd {
+ struct mt7915_tm_slot_time slot;
+ struct mt7915_tm_clean_txq clean;
+ struct mt7915_tm_cfg cfg;
++ struct mt7915_tm_mu_rx_aid rx_aid;
+ u8 test[72];
+ } param;
+ } __packed;
+@@ -109,6 +117,16 @@ enum {
+ TAM_ARB_OP_MODE_FORCE_SU = 5,
+ };
+
++enum {
++ TM_CBW_20MHZ,
++ TM_CBW_40MHZ,
++ TM_CBW_80MHZ,
++ TM_CBW_10MHZ,
++ TM_CBW_5MHZ,
++ TM_CBW_160MHZ,
++ TM_CBW_8080MHZ,
++};
++
+ struct mt7915_tm_rx_stat_band {
+ u8 category;
+
+@@ -130,4 +148,264 @@ struct mt7915_tm_rx_stat_band {
+ __le16 mdrdy_cnt_ofdm;
+ };
+
++struct mt7915_tm_muru_comm {
++ u8 ppdu_format;
++ u8 sch_type;
++ u8 band;
++ u8 wmm_idx;
++ u8 spe_idx;
++ u8 proc_type;
++};
++
++struct mt7915_tm_muru_dl_usr {
++ __le16 wlan_idx;
++ u8 ru_alloc_seg;
++ u8 ru_idx;
++ u8 ldpc;
++ u8 nss;
++ u8 mcs;
++ u8 mu_group_idx;
++ u8 vht_groud_id;
++ u8 vht_up;
++ u8 he_start_stream;
++ u8 he_mu_spatial;
++ u8 ack_policy;
++ __le16 tx_power_alpha;
++};
++
++struct mt7915_tm_muru_dl {
++ u8 user_num;
++ u8 tx_mode;
++ u8 bw;
++ u8 gi;
++ u8 ltf;
++ /* sigB */
++ u8 mcs;
++ u8 dcm;
++ u8 cmprs;
++
++ u8 tx_power;
++ u8 ru[8];
++ u8 c26[2];
++ u8 ack_policy;
++
++ struct mt7915_tm_muru_dl_usr usr[16];
++};
++
++struct mt7915_tm_muru_ul_usr {
++ __le16 wlan_idx;
++ u8 ru_alloc;
++ u8 ru_idx;
++ u8 ldpc;
++ u8 nss;
++ u8 mcs;
++ u8 target_rssi;
++ __le32 trig_pkt_size;
++};
++
++struct mt7915_tm_muru_ul {
++ u8 user_num;
++
++ /* UL TX */
++ u8 trig_type;
++ __le16 trig_cnt;
++ __le16 trig_intv;
++ u8 bw;
++ u8 gi_ltf;
++ __le16 ul_len;
++ u8 pad;
++ u8 trig_ta[ETH_ALEN];
++ u8 ru[8];
++ u8 c26[2];
++
++ struct mt7915_tm_muru_ul_usr usr[16];
++ /* HE TB RX Debug */
++ __le32 rx_hetb_nonsf_en_bitmap;
++ __le32 rx_hetb_cfg[2];
++
++ /* DL TX */
++ u8 ba_type;
++};
++
++struct mt7915_tm_muru {
++ __le32 cfg_comm;
++ __le32 cfg_dl;
++ __le32 cfg_ul;
++
++ struct mt7915_tm_muru_comm comm;
++ struct mt7915_tm_muru_dl dl;
++ struct mt7915_tm_muru_ul ul;
++};
++
++#define MURU_PPDU_HE_MU BIT(3)
++
++/* Common Config */
++/* #define MURU_COMM_PPDU_FMT BIT(0) */
++/* #define MURU_COMM_SCH_TYPE BIT(1) */
++/* #define MURU_COMM_BAND BIT(2) */
++/* #define MURU_COMM_WMM BIT(3) */
++/* #define MURU_COMM_SPE_IDX BIT(4) */
++/* #define MURU_COMM_PROC_TYPE BIT(5) */
++/* #define MURU_COMM_SET (MURU_COMM_PPDU_FMT | MURU_COMM_BAND | \ */
++/* MURU_COMM_WMM | MURU_COMM_SPE_IDX) */
++/* DL Config */
++#define MURU_DL_BW BIT(0)
++#define MURU_DL_GI BIT(1)
++#define MURU_DL_TX_MODE BIT(2)
++#define MURU_DL_TONE_PLAN BIT(3)
++#define MURU_DL_USER_CNT BIT(4)
++#define MURU_DL_LTF BIT(5)
++#define MURU_DL_SIGB_MCS BIT(6)
++#define MURU_DL_SIGB_DCM BIT(7)
++#define MURU_DL_SIGB_CMPRS BIT(8)
++#define MURU_DL_ACK_POLICY BIT(9)
++#define MURU_DL_TXPOWER BIT(10)
++/* DL Per User Config */
++#define MURU_DL_USER_WLAN_ID BIT(16)
++#define MURU_DL_USER_COD BIT(17)
++#define MURU_DL_USER_MCS BIT(18)
++#define MURU_DL_USER_NSS BIT(19)
++#define MURU_DL_USER_RU_ALLOC BIT(20)
++#define MURU_DL_USER_MUMIMO_GRP BIT(21)
++#define MURU_DL_USER_MUMIMO_VHT BIT(22)
++#define MURU_DL_USER_ACK_POLICY BIT(23)
++#define MURU_DL_USER_MUMIMO_HE BIT(24)
++#define MURU_DL_USER_PWR_ALPHA BIT(25)
++#define MURU_DL_SET (GENMASK(7, 0) | GENMASK(20, 16) | BIT(25))
++
++#define MAX_PHASE_GROUP_NUM 9
++
++struct mt7915_tm_txbf_phase {
++ u8 status;
++ struct {
++ u8 r0_uh;
++ u8 r0_h;
++ u8 r0_m;
++ u8 r0_l;
++ u8 r0_ul;
++ u8 r1_uh;
++ u8 r1_h;
++ u8 r1_m;
++ u8 r1_l;
++ u8 r1_ul;
++ u8 r2_uh;
++ u8 r2_h;
++ u8 r2_m;
++ u8 r2_l;
++ u8 r2_ul;
++ u8 r3_uh;
++ u8 r3_h;
++ u8 r3_m;
++ u8 r3_l;
++ u8 r3_ul;
++ u8 r2_uh_sx2;
++ u8 r2_h_sx2;
++ u8 r2_m_sx2;
++ u8 r2_l_sx2;
++ u8 r2_ul_sx2;
++ u8 r3_uh_sx2;
++ u8 r3_h_sx2;
++ u8 r3_m_sx2;
++ u8 r3_l_sx2;
++ u8 r3_ul_sx2;
++ u8 m_t0_h;
++ u8 m_t1_h;
++ u8 m_t2_h;
++ u8 m_t2_h_sx2;
++ u8 r0_reserved;
++ u8 r1_reserved;
++ u8 r2_reserved;
++ u8 r3_reserved;
++ u8 r2_sx2_reserved;
++ u8 r3_sx2_reserved;
++ } phase;
++};
++
++struct mt7915_tm_pfmu_tag1 {
++ __le32 pfmu_idx:10;
++ __le32 ebf:1;
++ __le32 data_bw:2;
++ __le32 lm:2;
++ __le32 is_mu:1;
++ __le32 nr:3, nc:3;
++ __le32 codebook:2;
++ __le32 ngroup:2;
++ __le32 _rsv:2;
++ __le32 invalid_prof:1;
++ __le32 rmsd:3;
++
++ __le32 col_id1:6, row_id1:10;
++ __le32 col_id2:6, row_id2:10;
++ __le32 col_id3:6, row_id3:10;
++ __le32 col_id4:6, row_id4:10;
++
++ __le32 ru_start_id:7;
++ __le32 _rsv1:1;
++ __le32 ru_end_id:7;
++ __le32 _rsv2:1;
++ __le32 mob_cal_en:1;
++ __le32 _rsv3:15;
++
++ __le32 snr_sts0:8, snr_sts1:8, snr_sts2:8, snr_sts3:8;
++ __le32 snr_sts4:8, snr_sts5:8, snr_sts6:8, snr_sts7:8;
++
++ __le32 _rsv4;
++} __packed;
++
++struct mt7915_tm_pfmu_tag2 {
++ __le32 smart_ant:24;
++ __le32 se_idx:5;
++ __le32 _rsv:3;
++
++ __le32 _rsv1:8;
++ __le32 rmsd_thres:3;
++ __le32 _rsv2:5;
++ __le32 ibf_timeout:8;
++ __le32 _rsv3:8;
++
++ __le32 _rsv4:16;
++ __le32 ibf_data_bw:2;
++ __le32 ibf_nc:3;
++ __le32 ibf_nr:3;
++ __le32 ibf_ru:8;
++
++ __le32 mob_delta_t:8;
++ __le32 mob_lq_result:7;
++ __le32 _rsv5:1;
++ __le32 _rsv6:16;
++
++ __le32 _rsv7;
++} __packed;
++
++struct mt7915_tm_pfmu_tag {
++ struct mt7915_tm_pfmu_tag1 t1;
++ struct mt7915_tm_pfmu_tag2 t2;
++};
++
++struct mt7915_tm_pfmu_data {
++ __le16 subc_idx;
++ __le16 phi11;
++ __le16 phi21;
++ __le16 phi31;
++};
++
++struct mt7915_tm_ibf_cal_info {
++ u8 format_id;
++ u8 group_l_m_n;
++ u8 group;
++ bool sx2;
++ u8 status;
++ u8 cal_type;
++ u8 _rsv[2];
++ u8 buf[1000];
++} __packed;
++
++enum {
++ IBF_PHASE_CAL_UNSPEC,
++ IBF_PHASE_CAL_NORMAL,
++ IBF_PHASE_CAL_VERIFY,
++ IBF_PHASE_CAL_NORMAL_INSTRUMENT,
++ IBF_PHASE_CAL_VERIFY_INSTRUMENT,
++};
++
+ #endif
+diff --git a/testmode.c b/testmode.c
+index 1d0d5d30..7a9ed543 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -27,28 +27,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
+ };
+ EXPORT_SYMBOL_GPL(mt76_tm_policy);
+
+-void mt76_testmode_tx_pending(struct mt76_phy *phy)
++static void
++mt76_testmode_queue_tx(struct mt76_phy *phy, struct mt76_wcid *wcid,
++ struct sk_buff *skb, struct mt76_queue *q, int qid,
++ u16 limit)
+ {
+ struct mt76_testmode_data *td = &phy->test;
+ struct mt76_dev *dev = phy->dev;
+- struct mt76_wcid *wcid = &dev->global_wcid;
+- struct sk_buff *skb = td->tx_skb;
+- struct mt76_queue *q;
+- u16 tx_queued_limit;
+- int qid;
+-
+- if (!skb || !td->tx_pending)
+- return;
++ u16 count = limit;
+
+- qid = skb_get_queue_mapping(skb);
+- q = phy->q_tx[qid];
+-
+- tx_queued_limit = td->tx_queued_limit ? td->tx_queued_limit : 1000;
+-
+- spin_lock_bh(&q->lock);
+-
+- while (td->tx_pending > 0 &&
+- td->tx_queued - td->tx_done < tx_queued_limit &&
++ while (td->tx_pending > 0 && count &&
+ q->queued < q->ndesc / 2) {
+ int ret;
+
+@@ -57,13 +45,65 @@ void mt76_testmode_tx_pending(struct mt76_phy *phy)
+ if (ret < 0)
+ break;
+
++ count--;
+ td->tx_pending--;
+ td->tx_queued++;
++
++ if (td->tx_rate_mode != MT76_TM_TX_MODE_HE_MU)
++ if (td->tx_queued - td->tx_done >= limit)
++ break;
+ }
+
+ dev->queue_ops->kick(dev, q);
++}
++
++void mt76_testmode_tx_pending(struct mt76_phy *phy)
++{
++ struct mt76_testmode_data *td = &phy->test;
++ struct mt76_testmode_entry_data *ed;
++ struct mt76_queue *q;
++ int qid;
++ u16 tx_queued_limit;
++ u32 remain;
++ bool is_mu;
++
++ if (!td->tx_pending)
++ return;
++
++ /* tx_queued_limit = td->tx_queued_limit ?: 100; */
++ tx_queued_limit = 100;
++
++ if (!td->aid) {
++ qid = skb_get_queue_mapping(td->tx_skb);
++ q = phy->q_tx[qid];
++ spin_lock_bh(&q->lock);
++ mt76_testmode_queue_tx(phy, &phy->dev->global_wcid,
++ td->tx_skb, q, qid, tx_queued_limit);
++ spin_unlock_bh(&q->lock);
++
++ return;
++ }
++
++ is_mu = td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU;
++ ed = mt76_testmode_entry_data(phy, td->cur_entry);
++ qid = skb_get_queue_mapping(ed->tx_skb);
++ q = phy->q_tx[qid];
++
++ spin_lock_bh(&q->lock);
++
++ remain = is_mu ? 1 : (td->tx_pending % td->tx_count) ?: td->tx_count;
++ if (remain < tx_queued_limit)
++ tx_queued_limit = remain;
++
++ mt76_testmode_queue_tx(phy, td->cur_entry, ed->tx_skb, q, qid, tx_queued_limit);
++
++ if (td->tx_pending % td->tx_count == 0 || is_mu)
++ td->cur_entry = list_next_entry(td->cur_entry, list);
+
+ spin_unlock_bh(&q->lock);
++
++ if (is_mu && td->tx_pending)
++ mt76_worker_schedule(&phy->dev->tx_worker);
+ }
+
+ static u32
+@@ -89,15 +129,31 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
+ }
+
+ static void
+-mt76_testmode_free_skb(struct mt76_phy *phy)
++mt76_testmode_free_skb(struct sk_buff **tx_skb)
++{
++ if (!(*tx_skb))
++ return;
++
++ dev_kfree_skb(*tx_skb);
++ *tx_skb = NULL;
++}
++
++static void
++mt76_testmode_free_skb_all(struct mt76_phy *phy)
+ {
+ struct mt76_testmode_data *td = &phy->test;
++ struct mt76_testmode_entry_data *ed = &td->ed;
++ struct mt76_wcid *wcid;
++
++ mt76_testmode_free_skb(&ed->tx_skb);
+
+- dev_kfree_skb(td->tx_skb);
+- td->tx_skb = NULL;
++ mt76_tm_for_each_entry(phy, wcid, ed)
++ mt76_testmode_free_skb(&ed->tx_skb);
+ }
+
+-int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
++static int
++mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
++ struct sk_buff **tx_skb, u8 (*addr)[ETH_ALEN])
+ {
+ #define MT_TXP_MAX_LEN 4095
+ u16 fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA |
+@@ -118,7 +174,8 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+ nfrags = len / MT_TXP_MAX_LEN;
+ head_len = nfrags ? MT_TXP_MAX_LEN : len;
+
+- if (len > IEEE80211_MAX_FRAME_LEN)
++ if (len > IEEE80211_MAX_FRAME_LEN ||
++ td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
+ fc |= IEEE80211_STYPE_QOS_DATA;
+
+ head = alloc_skb(head_len, GFP_KERNEL);
+@@ -127,9 +184,9 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+
+ hdr = __skb_put_zero(head, sizeof(*hdr));
+ hdr->frame_control = cpu_to_le16(fc);
+- memcpy(hdr->addr1, td->addr[0], ETH_ALEN);
+- memcpy(hdr->addr2, td->addr[1], ETH_ALEN);
+- memcpy(hdr->addr3, td->addr[2], ETH_ALEN);
++ memcpy(hdr->addr1, addr[0], ETH_ALEN);
++ memcpy(hdr->addr2, addr[1], ETH_ALEN);
++ memcpy(hdr->addr3, addr[2], ETH_ALEN);
+ skb_set_queue_mapping(head, IEEE80211_AC_BE);
+ get_random_bytes(__skb_put(head, head_len - sizeof(*hdr)),
+ head_len - sizeof(*hdr));
+@@ -153,7 +210,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+
+ frag = alloc_skb(frag_len, GFP_KERNEL);
+ if (!frag) {
+- mt76_testmode_free_skb(phy);
++ mt76_testmode_free_skb(tx_skb);
+ dev_kfree_skb(head);
+ return -ENOMEM;
+ }
+@@ -166,15 +223,14 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+ frag_tail = &(*frag_tail)->next;
+ }
+
+- mt76_testmode_free_skb(phy);
+- td->tx_skb = head;
++ mt76_testmode_free_skb(tx_skb);
++ *tx_skb = head;
+
+ return 0;
+ }
+-EXPORT_SYMBOL(mt76_testmode_alloc_skb);
+
+-static int
+-mt76_testmode_tx_init(struct mt76_phy *phy)
++int mt76_testmode_init_skb(struct mt76_phy *phy, u32 len,
++ struct sk_buff **tx_skb, u8 (*addr)[ETH_ALEN])
+ {
+ struct mt76_testmode_data *td = &phy->test;
+ struct ieee80211_tx_info *info;
+@@ -182,7 +238,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+ u8 max_nss = hweight8(phy->antenna_mask);
+ int ret;
+
+- ret = mt76_testmode_alloc_skb(phy, td->tx_mpdu_len);
++ ret = mt76_testmode_alloc_skb(phy, len, tx_skb, addr);
+ if (ret)
+ return ret;
+
+@@ -192,7 +248,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+ if (td->tx_antenna_mask)
+ max_nss = min_t(u8, max_nss, hweight8(td->tx_antenna_mask));
+
+- info = IEEE80211_SKB_CB(td->tx_skb);
++ info = IEEE80211_SKB_CB(*tx_skb);
+ rate = &info->control.rates[0];
+ rate->count = 1;
+ rate->idx = td->tx_rate_idx;
+@@ -264,6 +320,25 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+ out:
+ return 0;
+ }
++EXPORT_SYMBOL(mt76_testmode_init_skb);
++
++static int
++mt76_testmode_tx_init(struct mt76_phy *phy)
++{
++ struct mt76_testmode_entry_data *ed;
++ struct mt76_wcid *wcid;
++
++ mt76_tm_for_each_entry(phy, wcid, ed) {
++ int ret;
++
++ ret = mt76_testmode_init_skb(phy, ed->tx_mpdu_len,
++ &ed->tx_skb, ed->addr);
++ if (ret)
++ return ret;
++ }
++
++ return 0;
++}
+
+ static void
+ mt76_testmode_tx_start(struct mt76_phy *phy)
+@@ -274,6 +349,14 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
+ td->tx_queued = 0;
+ td->tx_done = 0;
+ td->tx_pending = td->tx_count;
++ if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
++ td->tx_pending = 1;
++ if (td->entry_num) {
++ td->tx_pending *= td->entry_num;
++ td->cur_entry = list_first_entry(&td->tm_entry_list,
++ struct mt76_wcid, list);
++ }
++
+ mt76_worker_schedule(&dev->tx_worker);
+ }
+
+@@ -292,7 +375,7 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
+ wait_event_timeout(dev->tx_wait, td->tx_done == td->tx_queued,
+ MT76_TM_TIMEOUT * HZ);
+
+- mt76_testmode_free_skb(phy);
++ mt76_testmode_free_skb_all(phy);
+ }
+
+ static inline void
+@@ -323,6 +406,8 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
+ memcpy(td->addr[0], phy->macaddr, ETH_ALEN);
+ memcpy(td->addr[1], phy->macaddr, ETH_ALEN);
+ memcpy(td->addr[2], phy->macaddr, ETH_ALEN);
++
++ INIT_LIST_HEAD(&phy->test.tm_entry_list);
+ }
+
+ static int
+@@ -332,8 +417,12 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
+ struct mt76_dev *dev = phy->dev;
+ int err;
+
+- if (prev_state == MT76_TM_STATE_TX_FRAMES)
++ if (prev_state == MT76_TM_STATE_TX_FRAMES) {
++ /* MU needs to clean hwq for free done event */
++ if (phy->test.tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
++ dev->test_ops->set_state(phy, MT76_TM_STATE_IDLE);
+ mt76_testmode_tx_stop(phy);
++ }
+
+ if (state == MT76_TM_STATE_TX_FRAMES) {
+ err = mt76_testmode_tx_init(phy);
+@@ -403,6 +492,44 @@ mt76_tm_get_u8(struct nlattr *attr, u8 *dest, u8 min, u8 max)
+ return 0;
+ }
+
++static int
++mt76_testmode_set_eeprom(struct mt76_phy *phy, struct nlattr **tb)
++{
++ struct mt76_dev *dev = phy->dev;
++ u8 action, val[MT76_TM_EEPROM_BLOCK_SIZE];
++ u32 offset = 0;
++ int err = -EINVAL;
++
++ if (!dev->test_ops->set_eeprom)
++ return -EOPNOTSUPP;
++
++ if (mt76_tm_get_u8(tb[MT76_TM_ATTR_EEPROM_ACTION], &action,
++ 0, MT76_TM_EEPROM_ACTION_MAX))
++ goto out;
++
++ if (tb[MT76_TM_ATTR_EEPROM_OFFSET]) {
++ struct nlattr *cur;
++ int rem, idx = 0;
++
++ offset = nla_get_u32(tb[MT76_TM_ATTR_EEPROM_OFFSET]);
++ if (!!(offset % MT76_TM_EEPROM_BLOCK_SIZE) ||
++ !tb[MT76_TM_ATTR_EEPROM_VAL])
++ goto out;
++
++ nla_for_each_nested(cur, tb[MT76_TM_ATTR_EEPROM_VAL], rem) {
++ if (nla_len(cur) != 1 || idx >= ARRAY_SIZE(val))
++ goto out;
++
++ val[idx++] = nla_get_u8(cur);
++ }
++ }
++
++ err = dev->test_ops->set_eeprom(phy, offset, val, action);
++
++out:
++ return err;
++}
++
+ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ void *data, int len)
+ {
+@@ -426,6 +553,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+
+ mutex_lock(&dev->mutex);
+
++ if (tb[MT76_TM_ATTR_EEPROM_ACTION]) {
++ err = mt76_testmode_set_eeprom(phy, tb);
++ goto out;
++ }
++
+ if (tb[MT76_TM_ATTR_RESET]) {
+ mt76_testmode_set_state(phy, MT76_TM_STATE_OFF);
+ memset(td, 0, sizeof(*td));
+@@ -452,7 +584,10 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
+ &td->tx_duty_cycle, 0, 99) ||
+ mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
+- &td->tx_power_control, 0, 1))
++ &td->tx_power_control, 0, 1) ||
++ mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &td->aid, 0, 16) ||
++ mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_ALLOC], &td->ru_alloc, 0, 0xff) ||
++ mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_IDX], &td->ru_idx, 0, 68))
+ goto out;
+
+ if (tb[MT76_TM_ATTR_TX_LENGTH]) {
+@@ -484,8 +619,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+
+ if (tb[MT76_TM_ATTR_TX_POWER]) {
+ struct nlattr *cur;
+- int idx = 0;
+- int rem;
++ int rem, idx = 0;
+
+ nla_for_each_nested(cur, tb[MT76_TM_ATTR_TX_POWER], rem) {
+ if (nla_len(cur) != 1 ||
+@@ -505,11 +639,45 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ if (nla_len(cur) != ETH_ALEN || idx >= 3)
+ goto out;
+
+- memcpy(td->addr[idx], nla_data(cur), ETH_ALEN);
++ memcpy(td->addr[idx++], nla_data(cur), ETH_ALEN);
++ }
++ }
++
++ if (tb[MT76_TM_ATTR_CFG]) {
++ struct nlattr *cur;
++ int rem, idx = 0;
++
++ nla_for_each_nested(cur, tb[MT76_TM_ATTR_CFG], rem) {
++ if (nla_len(cur) != 1 || idx >= 2)
++ goto out;
++
++ if (idx == 0)
++ td->cfg.type = nla_get_u8(cur);
++ else
++ td->cfg.enable = nla_get_u8(cur);
+ idx++;
+ }
+ }
+
++ if (tb[MT76_TM_ATTR_TXBF_ACT]) {
++ struct nlattr *cur;
++ int rem, idx = 0;
++
++ if (!tb[MT76_TM_ATTR_TXBF_PARAM] ||
++ mt76_tm_get_u8(tb[MT76_TM_ATTR_TXBF_ACT], &td->txbf_act,
++ 0, MT76_TM_TXBF_ACT_MAX))
++ goto out;
++
++ memset(td->txbf_param, 0, sizeof(td->txbf_param));
++ nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
++ if (nla_len(cur) != 2 ||
++ idx >= ARRAY_SIZE(td->txbf_param))
++ goto out;
++
++ td->txbf_param[idx++] = nla_get_u16(cur);
++ }
++ }
++
+ if (dev->test_ops->set_params) {
+ err = dev->test_ops->set_params(phy, tb, state);
+ if (err)
+@@ -574,6 +742,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ struct mt76_phy *phy = hw->priv;
+ struct mt76_dev *dev = phy->dev;
+ struct mt76_testmode_data *td = &phy->test;
++ struct mt76_testmode_entry_data *ed = &td->ed;
+ struct nlattr *tb[NUM_MT76_TM_ATTRS] = {};
+ int err = 0;
+ void *a;
+@@ -606,6 +775,19 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ goto out;
+ }
+
++ if (tb[MT76_TM_ATTR_AID]) {
++ struct mt76_wcid *wcid;
++ u8 aid;
++
++ err = mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &aid, 1, 16);
++ if (err)
++ goto out;
++
++ mt76_tm_for_each_entry(phy, wcid, ed)
++ if (ed->aid == aid)
++ ed = mt76_testmode_entry_data(phy, wcid);
++ }
++
+ mt76_testmode_init_defaults(phy);
+
+ err = -EMSGSIZE;
+@@ -618,12 +800,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ goto out;
+
+ if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
+- nla_put_u32(msg, MT76_TM_ATTR_TX_LENGTH, td->tx_mpdu_len) ||
+ nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_MODE, td->tx_rate_mode) ||
+- nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_NSS, td->tx_rate_nss) ||
+- nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_IDX, td->tx_rate_idx) ||
+ nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_SGI, td->tx_rate_sgi) ||
+- nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, td->tx_rate_ldpc) ||
+ nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
+ (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
+ nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
+@@ -643,6 +821,15 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ nla_put_u8(msg, MT76_TM_ATTR_FREQ_OFFSET, td->freq_offset)))
+ goto out;
+
++ if (nla_put_u32(msg, MT76_TM_ATTR_TX_LENGTH, ed->tx_mpdu_len) ||
++ nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_NSS, ed->tx_rate_nss) ||
++ nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_IDX, ed->tx_rate_idx) ||
++ nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, ed->tx_rate_ldpc) ||
++ nla_put_u8(msg, MT76_TM_ATTR_AID, ed->aid) ||
++ nla_put_u8(msg, MT76_TM_ATTR_RU_ALLOC, ed->ru_alloc) ||
++ nla_put_u8(msg, MT76_TM_ATTR_RU_IDX, ed->ru_idx))
++ goto out;
++
+ if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER)) {
+ a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
+ if (!a)
+diff --git a/testmode.h b/testmode.h
+index 89613266..57949f2b 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -6,6 +6,8 @@
+ #define __MT76_TESTMODE_H
+
+ #define MT76_TM_TIMEOUT 10
++#define MT76_TM_MAX_ENTRY_NUM 16
++#define MT76_TM_EEPROM_BLOCK_SIZE 16
+
+ /**
+ * enum mt76_testmode_attr - testmode attributes inside NL80211_ATTR_TESTDATA
+@@ -47,6 +49,15 @@
+ * @MT76_TM_ATTR_DRV_DATA: driver specific netlink attrs (nested)
+ *
+ * @MT76_TM_ATTR_MAC_ADDRS: array of nested MAC addresses (nested)
++ *
++ * @MT76_TM_ATTR_EEPROM_ACTION: eeprom setting actions
++ * (u8, see &enum mt76_testmode_eeprom_action)
++ * @MT76_TM_ATTR_EEPROM_OFFSET: offset of eeprom data block for writing (u32)
++ * @MT76_TM_ATTR_EEPROM_VAL: values for writing into a 16-byte data block
++ * (nested, u8 attrs)
++ *
++ * @MT76_TM_ATTR_CFG: config testmode rf feature (nested, see &mt76_testmode_cfg)
++ *
+ */
+ enum mt76_testmode_attr {
+ MT76_TM_ATTR_UNSPEC,
+@@ -84,6 +95,17 @@ enum mt76_testmode_attr {
+ MT76_TM_ATTR_DRV_DATA,
+
+ MT76_TM_ATTR_MAC_ADDRS,
++ MT76_TM_ATTR_AID,
++ MT76_TM_ATTR_RU_ALLOC,
++ MT76_TM_ATTR_RU_IDX,
++
++ MT76_TM_ATTR_EEPROM_ACTION,
++ MT76_TM_ATTR_EEPROM_OFFSET,
++ MT76_TM_ATTR_EEPROM_VAL,
++
++ MT76_TM_ATTR_CFG,
++ MT76_TM_ATTR_TXBF_ACT,
++ MT76_TM_ATTR_TXBF_PARAM,
+
+ /* keep last */
+ NUM_MT76_TM_ATTRS,
+@@ -198,4 +220,57 @@ enum mt76_testmode_tx_mode {
+
+ extern const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS];
+
++/**
++ * enum mt76_testmode_eeprom_action - eeprom setting actions
++ *
++ * @MT76_TM_EEPROM_ACTION_UPDATE_DATA: update rf values to specific
++ * eeprom data block
++ * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
++ * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
++ */
++enum mt76_testmode_eeprom_action {
++ MT76_TM_EEPROM_ACTION_UPDATE_DATA,
++ MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE,
++ MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE,
++
++ /* keep last */
++ NUM_MT76_TM_EEPROM_ACTION,
++ MT76_TM_EEPROM_ACTION_MAX = NUM_MT76_TM_EEPROM_ACTION - 1,
++};
++
++/**
++ * enum mt76_testmode_cfg - packet tx phy mode
++ *
++ * @MT76_TM_EEPROM_ACTION_UPDATE_DATA: update rf values to specific
++ * eeprom data block
++ * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
++ * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
++ */
++enum mt76_testmode_cfg {
++ MT76_TM_CFG_TSSI,
++ MT76_TM_CFG_DPD,
++ MT76_TM_CFG_RATE_POWER_OFFSET,
++ MT76_TM_CFG_THERMAL_COMP,
++
++ /* keep last */
++ NUM_MT76_TM_CFG,
++ MT76_TM_CFG_MAX = NUM_MT76_TM_CFG - 1,
++};
++
++enum mt76_testmode_txbf_act {
++ MT76_TM_TXBF_ACT_INIT,
++ MT76_TM_TXBF_ACT_UPDATE_CH,
++ MT76_TM_TXBF_ACT_PHASE_COMP,
++ MT76_TM_TXBF_ACT_TX_PREP,
++ MT76_TM_TXBF_ACT_IBF_PROF_UPDATE,
++ MT76_TM_TXBF_ACT_EBF_PROF_UPDATE,
++ MT76_TM_TXBF_ACT_PHASE_CAL,
++ MT76_TM_TXBF_ACT_PROF_UPDATE_ALL,
++ MT76_TM_TXBF_ACT_E2P_UPDATE,
++
++ /* keep last */
++ NUM_MT76_TM_TXBF_ACT,
++ MT76_TM_TXBF_ACT_MAX = NUM_MT76_TM_TXBF_ACT - 1,
++};
++
+ #endif
+diff --git a/tools/fields.c b/tools/fields.c
+index e3f69089..6e36ab27 100644
+--- a/tools/fields.c
++++ b/tools/fields.c
+@@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
+ [MT76_TM_STATE_IDLE] = "idle",
+ [MT76_TM_STATE_TX_FRAMES] = "tx_frames",
+ [MT76_TM_STATE_RX_FRAMES] = "rx_frames",
++ [MT76_TM_STATE_TX_CONT] = "tx_cont",
+ };
+
+ static const char * const testmode_tx_mode[] = {
+@@ -201,6 +202,63 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
+ printf("%srx_per=%.02f%%\n", prefix, 100 * failed / total);
+ }
+
++static bool parse_mac(const struct tm_field *field, int idx,
++ struct nl_msg *msg, const char *val)
++{
++#define ETH_ALEN 6
++ bool ret = true;
++ char *str, *cur, *ap;
++ void *a;
++
++ ap = str = strdup(val);
++
++ a = nla_nest_start(msg, idx);
++
++ idx = 0;
++ while ((cur = strsep(&ap, ",")) != NULL) {
++ unsigned char addr[ETH_ALEN];
++ char *val, *tmp = cur;
++ int i = 0;
++
++ while ((val = strsep(&tmp, ":")) != NULL) {
++ if (i >= ETH_ALEN)
++ break;
++
++ addr[i++] = strtoul(val, NULL, 16);
++ }
++
++ nla_put(msg, idx, ETH_ALEN, addr);
++
++ idx++;
++ }
++
++ nla_nest_end(msg, a);
++
++ free(str);
++
++ return ret;
++}
++
++static void print_mac(const struct tm_field *field, struct nlattr *attr)
++{
++#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
++#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
++ unsigned char addr[3][6];
++ struct nlattr *cur;
++ int idx = 0;
++ int rem;
++
++ nla_for_each_nested(cur, attr, rem) {
++ if (nla_len(cur) != 6)
++ continue;
++ memcpy(addr[idx++], nla_data(cur), 6);
++ }
++
++ printf("" MACSTR "," MACSTR "," MACSTR "",
++ MAC2STR(addr[0]), MAC2STR(addr[1]), MAC2STR(addr[2]));
++
++ return;
++}
+
+ #define FIELD_GENERIC(_field, _name, ...) \
+ [FIELD_NAME(_field)] = { \
+@@ -250,6 +308,13 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
+ ##__VA_ARGS__ \
+ )
+
++#define FIELD_MAC(_field, _name) \
++ [FIELD_NAME(_field)] = { \
++ .name = _name, \
++ .parse = parse_mac, \
++ .print = print_mac \
++ }
++
+ #define FIELD_NAME(_field) MT76_TM_RX_ATTR_##_field
+ static const struct tm_field rx_fields[NUM_MT76_TM_RX_ATTRS] = {
+ FIELD_RO(s32, FREQ_OFFSET, "freq_offset"),
+@@ -300,10 +365,18 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
+ FIELD(u8, TX_RATE_LDPC, "tx_rate_ldpc"),
+ FIELD(u8, TX_RATE_STBC, "tx_rate_stbc"),
+ FIELD(u8, TX_LTF, "tx_ltf"),
++ FIELD(u8, TX_DUTY_CYCLE, "tx_duty_cycle"),
++ FIELD(u32, TX_IPG, "tx_ipg"),
++ FIELD(u32, TX_TIME, "tx_time"),
+ FIELD(u8, TX_POWER_CONTROL, "tx_power_control"),
+ FIELD_ARRAY(u8, TX_POWER, "tx_power"),
+ FIELD(u8, TX_ANTENNA, "tx_antenna"),
++ FIELD(u8, TX_SPE_IDX, "tx_spe_idx"),
+ FIELD(u32, FREQ_OFFSET, "freq_offset"),
++ FIELD(u8, AID, "aid"),
++ FIELD(u8, RU_ALLOC, "ru_alloc"),
++ FIELD(u8, RU_IDX, "ru_idx"),
++ FIELD_MAC(MAC_ADDRS, "mac_addrs"),
+ FIELD_NESTED_RO(STATS, stats, "",
+ .print_extra = print_extra_stats),
+ };
+@@ -322,9 +395,16 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
+ [MT76_TM_ATTR_TX_RATE_LDPC] = { .type = NLA_U8 },
+ [MT76_TM_ATTR_TX_RATE_STBC] = { .type = NLA_U8 },
+ [MT76_TM_ATTR_TX_LTF] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_TX_DUTY_CYCLE] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_TX_IPG] = { .type = NLA_U32 },
++ [MT76_TM_ATTR_TX_TIME] = { .type = NLA_U32 },
+ [MT76_TM_ATTR_TX_POWER_CONTROL] = { .type = NLA_U8 },
+ [MT76_TM_ATTR_TX_ANTENNA] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_TX_SPE_IDX] = { .type = NLA_U8 },
+ [MT76_TM_ATTR_FREQ_OFFSET] = { .type = NLA_U32 },
++ [MT76_TM_ATTR_AID] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_RU_ALLOC] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_RU_IDX] = { .type = NLA_U8 },
+ [MT76_TM_ATTR_STATS] = { .type = NLA_NESTED },
+ };
+
+diff --git a/tx.c b/tx.c
+index c8d78b0a..c7cd842c 100644
+--- a/tx.c
++++ b/tx.c
+@@ -245,8 +245,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
+ if (mt76_is_testmode_skb(dev, skb, &hw)) {
+ struct mt76_phy *phy = hw->priv;
+
+- if (skb == phy->test.tx_skb)
+- phy->test.tx_done++;
++ phy->test.tx_done++;
+ if (phy->test.tx_queued == phy->test.tx_done)
+ wake_up(&dev->tx_wait);
+
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
new file mode 100644
index 0000000..a9882c1
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
@@ -0,0 +1,846 @@
+From 2ae175cba8bc0192c251c380d00448fb08a709a5 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Wed, 31 Aug 2022 20:06:52 +0800
+Subject: [PATCH 1113/1128] mt76: testmode: add pre-cal support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
+---
+ eeprom.c | 6 +-
+ mt76.h | 1 +
+ mt76_connac_mcu.h | 1 +
+ mt7915/eeprom.h | 34 +++-
+ mt7915/mcu.c | 27 ++-
+ mt7915/mt7915.h | 5 +
+ mt7915/testmode.c | 425 +++++++++++++++++++++++++++++++++++++++++++++-
+ mt7915/testmode.h | 36 ++++
+ testmode.c | 15 +-
+ testmode.h | 17 ++
+ tools/fields.c | 8 +
+ 11 files changed, 562 insertions(+), 13 deletions(-)
+
+diff --git a/eeprom.c b/eeprom.c
+index 1e41b94d..e083964b 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
+ }
+
+ #ifdef CONFIG_NL80211_TESTMODE
+- dev->test_mtd.name = devm_kstrdup(dev->dev, part, GFP_KERNEL);
+- dev->test_mtd.offset = offset;
++ if (len == dev->eeprom.size) {
++ dev->test_mtd.name = devm_kstrdup(dev->dev, part, GFP_KERNEL);
++ dev->test_mtd.offset = offset;
++ }
+ #endif
+
+ out_put_node:
+diff --git a/mt76.h b/mt76.h
+index 32e2dea0..2beb1056 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -636,6 +636,7 @@ struct mt76_testmode_ops {
+ enum mt76_testmode_state new_state);
+ int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
+ int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
++ int (*dump_precal)(struct mt76_phy *phy, struct sk_buff *msg, int flag, int type);
+ };
+
+ struct mt76_testmode_entry_data {
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index e10e92b6..4e489244 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -979,6 +979,7 @@ enum {
+
+ /* ext event table */
+ enum {
++ MCU_EXT_EVENT_RF_TEST = 0x4,
+ MCU_EXT_EVENT_PS_SYNC = 0x5,
+ MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
+ MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
+diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
+index f3e56817..88aaa16a 100644
+--- a/mt7915/eeprom.h
++++ b/mt7915/eeprom.h
+@@ -39,10 +39,18 @@ enum mt7915_eeprom_field {
+ };
+
+ #define MT_EE_WIFI_CAL_GROUP BIT(0)
+-#define MT_EE_WIFI_CAL_DPD GENMASK(2, 1)
++#define MT_EE_WIFI_CAL_DPD_2G BIT(2)
++#define MT_EE_WIFI_CAL_DPD_5G BIT(1)
++#define MT_EE_WIFI_CAL_DPD_6G BIT(3)
++#define MT_EE_WIFI_CAL_DPD GENMASK(3, 1)
+ #define MT_EE_CAL_UNIT 1024
+-#define MT_EE_CAL_GROUP_SIZE (49 * MT_EE_CAL_UNIT + 16)
+-#define MT_EE_CAL_DPD_SIZE (54 * MT_EE_CAL_UNIT)
++#define MT_EE_CAL_GROUP_SIZE_7915 (49 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_GROUP_SIZE_7916 (54 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_GROUP_SIZE_7975 (54 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_GROUP_SIZE_7976 (94 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_GROUP_SIZE_7916_6G (94 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_DPD_SIZE_V1 (54 * MT_EE_CAL_UNIT)
++#define MT_EE_CAL_DPD_SIZE_V2 (300 * MT_EE_CAL_UNIT)
+
+ #define MT_EE_WIFI_CONF0_TX_PATH GENMASK(2, 0)
+ #define MT_EE_WIFI_CONF0_BAND_SEL GENMASK(7, 6)
+@@ -155,6 +163,26 @@ mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band)
+ return val & MT_EE_WIFI_CONF7_TSSI0_5G;
+ }
+
++static inline u32
++mt7915_get_cal_group_size(struct mt7915_dev *dev)
++{
++ u8 *eep = dev->mt76.eeprom.data;
++ u32 val;
++
++ if (is_mt7915(&dev->mt76)) {
++ return MT_EE_CAL_GROUP_SIZE_7915;
++ } else if (is_mt7916(&dev->mt76)) {
++ val = eep[MT_EE_WIFI_CONF + 1];
++ val = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val);
++ return (val == MT_EE_V2_BAND_SEL_6GHZ) ? MT_EE_CAL_GROUP_SIZE_7916_6G :
++ MT_EE_CAL_GROUP_SIZE_7916;
++ } else if (mt7915_check_adie(dev, false)) {
++ return MT_EE_CAL_GROUP_SIZE_7976;
++ } else {
++ return MT_EE_CAL_GROUP_SIZE_7975;
++ }
++}
++
+ extern const u8 mt7915_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
+
+ #endif
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 5687e136..d1ff73a9 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -371,6 +371,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ case MCU_EXT_EVENT_BF_STATUS_READ:
+ mt7915_tm_txbf_status_read(dev, skb);
+ break;
++ case MCU_EXT_EVENT_RF_TEST:
++ mt7915_tm_rf_test_event(dev, skb);
++ break;
+ #endif
+ default:
+ break;
+@@ -2882,7 +2885,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+ u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
+ u32 total = MT_EE_CAL_GROUP_SIZE;
+
+- if (1 || !(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
++ if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
+ return 0;
+
+ /*
+@@ -2962,11 +2965,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+ {
+ struct mt7915_dev *dev = phy->dev;
+ struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
+- u16 total = 2, center_freq = chandef->center_freq1;
++ enum nl80211_band band = chandef->chan->band;
++ u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
++ u16 center_freq = chandef->center_freq1;
+ u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
++ u8 dpd_mask, cal_num = is_mt7915(&dev->mt76) ? 2 : 3;
+ int idx;
+
+- if (1 || !(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
++ switch (band) {
++ case NL80211_BAND_2GHZ:
++ dpd_mask = MT_EE_WIFI_CAL_DPD_2G;
++ break;
++ case NL80211_BAND_5GHZ:
++ dpd_mask = MT_EE_WIFI_CAL_DPD_5G;
++ break;
++ case NL80211_BAND_6GHZ:
++ dpd_mask = MT_EE_WIFI_CAL_DPD_6G;
++ break;
++ default:
++ dpd_mask = 0;
++ break;
++ }
++
++ if (!(eep[offs] & dpd_mask))
+ return 0;
+
+ idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index cf7fcdfc..cafd4389 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -402,6 +402,10 @@ struct mt7915_dev {
+ struct rchan *relay_fwlog;
+
+ void *cal;
++ u32 cur_prek_offset;
++ u8 dpd_chan_num_2g;
++ u8 dpd_chan_num_5g;
++ u8 dpd_chan_num_6g;
+
+ struct {
+ u8 debug_wm;
+@@ -635,6 +639,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
+ void mt7915_mcu_exit(struct mt7915_dev *dev);
+ int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
++void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
+
+ static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
+ {
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index d9d43cb7..c6a5837e 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -5,6 +5,7 @@
+ #include "mac.h"
+ #include "mcu.h"
+ #include "testmode.h"
++#include "eeprom.h"
+
+ enum {
+ TM_CHANGED_TXPOWER,
+@@ -1578,17 +1579,15 @@ mt7915_tm_rf_switch_mode(struct mt7915_dev *dev, u32 oper)
+ static int
+ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+ {
+-#define TX_CONT_START 0x05
+-#define TX_CONT_STOP 0x06
+ struct mt7915_dev *dev = phy->dev;
+ struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
+ int freq1 = ieee80211_frequency_to_channel(chandef->center_freq1);
+ struct mt76_testmode_data *td = &phy->mt76->test;
+- u32 func_idx = en ? TX_CONT_START : TX_CONT_STOP;
++ u32 func_idx = en ? RF_TEST_TX_CONT_START : RF_TEST_TX_CONT_STOP;
+ u8 rate_idx = td->tx_rate_idx, mode;
+ u16 rateval;
+ struct mt7915_tm_rf_test req = {
+- .action = 1,
++ .action = RF_ACT_IN_RFTEST,
+ .icap_len = 120,
+ .op.rf.func_idx = cpu_to_le32(func_idx),
+ };
+@@ -1673,6 +1672,316 @@ out:
+ sizeof(req), true);
+ }
+
++static int
++mt7915_tm_group_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
++{
++ u8 *eeprom;
++ u32 i, group_size, dpd_size, size, offs, *pre_cal;
++ int ret = 0;
++ struct mt7915_dev *dev = phy->dev;
++ struct mt76_dev *mdev = &dev->mt76;
++ struct mt7915_tm_rf_test req = {
++ .action = RF_ACT_IN_RFTEST,
++ .icap_len = 8,
++ .op.rf.func_idx = cpu_to_le32(RF_TEST_RE_CAL),
++ };
++
++ if (!dev->flash_mode && !dev->bin_file_mode) {
++ dev_err(dev->mt76.dev, "Currently not in FLASH or BIN MODE,return!\n");
++ return 1;
++ }
++
++ eeprom = mdev->eeprom.data;
++ dev->cur_prek_offset = 0;
++ group_size = mt7915_get_cal_group_size(dev);
++ dpd_size = is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2;
++ size = group_size + dpd_size;
++ offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
++
++ switch (state) {
++ case MT76_TM_STATE_GROUP_PREK:
++ req.op.rf.param.cal_param.func_data = cpu_to_le32(RF_PRE_CAL);
++
++ if (!dev->cal) {
++ dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
++ if (!dev->cal)
++ return -ENOMEM;
++ }
++
++ ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_TEST), &req,
++ sizeof(req), true);
++
++ if (!ret)
++ eeprom[offs] |= MT_EE_WIFI_CAL_GROUP;
++ break;
++ case MT76_TM_STATE_GROUP_PREK_DUMP:
++ pre_cal = (u32 *)dev->cal;
++ if (!pre_cal) {
++ dev_info(dev->mt76.dev, "Not group pre-cal yet!\n");
++ return ret;
++ }
++ dev_info(dev->mt76.dev, "Group Pre-Cal:\n");
++ for (i = 0; i < (group_size / sizeof(u32)); i += 4) {
++ dev_info(dev->mt76.dev, "[0x%08x] 0x%8x 0x%8x 0x%8x 0x%8x\n",
++ i * sizeof(u32), pre_cal[i], pre_cal[i + 1],
++ pre_cal[i + 2], pre_cal[i + 3]);
++ }
++ break;
++ case MT76_TM_STATE_GROUP_PREK_CLEAN:
++ pre_cal = (u32 *)dev->cal;
++ if (!pre_cal)
++ return ret;
++ memset(pre_cal, 0, group_size);
++ eeprom[offs] &= ~MT_EE_WIFI_CAL_GROUP;
++ break;
++ default:
++ return -EINVAL;
++ }
++ return ret;
++}
++
++static int
++mt7915_tm_dpd_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
++{
++#define DPD_2G_CH_BW20_BITMAP_0 0x444
++#define DPD_5G_CH_BW20_BITMAP_0 0xffffc0ff
++#define DPD_5G_CH_BW20_BITMAP_1 0x3
++#define DPD_5G_CH_BW20_BITMAP_7915_0 0x7dffc0ff
++#define DPD_6G_CH_BW20_BITMAP_0 0xffffffff
++#define DPD_6G_CH_BW20_BITMAP_1 0x07ffffff
++ bool is_set = false;
++ u8 band, do_precal, *eeprom;
++ u16 bw20_size, bw160_size;
++ u32 i, j, *bw160_freq, bw160_5g_freq[] = {5250, 5570, 5815};
++ u32 bw160_6g_freq[] = {6025, 6185, 6345, 6505, 6665, 6825, 6985};
++ u32 shift, freq, group_size, dpd_size, size, offs, *pre_cal, dpd_ch_bw20_bitmap[2] = {0};
++ __le32 func_data = 0;
++ int ret = 0;
++ struct mt7915_dev *dev = phy->dev;
++ struct mt76_dev *mdev = &dev->mt76;
++ struct mt76_phy *mphy = phy->mt76;
++ struct cfg80211_chan_def chandef_backup, *chandef = &mphy->chandef;
++ struct ieee80211_channel chan_backup, chan, *bw20_ch;
++ struct mt7915_tm_rf_test req = {
++ .action = RF_ACT_IN_RFTEST,
++ .icap_len = 8,
++ .op.rf.func_idx = cpu_to_le32(RF_TEST_RE_CAL),
++ };
++
++ if (!dev->flash_mode && !dev->bin_file_mode) {
++ dev_err(dev->mt76.dev, "Currently not in FLASH or BIN MODE,return!\n");
++ return -EOPNOTSUPP;
++ }
++
++ eeprom = mdev->eeprom.data;
++ dev->cur_prek_offset = 0;
++ group_size = mt7915_get_cal_group_size(dev);
++ dev->dpd_chan_num_2g = hweight32(DPD_2G_CH_BW20_BITMAP_0);
++ if (is_mt7915(&dev->mt76)) {
++ dev->dpd_chan_num_5g = hweight32(DPD_5G_CH_BW20_BITMAP_7915_0);
++ dev->dpd_chan_num_6g = 0;
++ dpd_size = MT_EE_CAL_DPD_SIZE_V1;
++ offs = MT_EE_DO_PRE_CAL;
++ } else {
++ dev->dpd_chan_num_5g = hweight32(DPD_5G_CH_BW20_BITMAP_0) +
++ hweight32(DPD_5G_CH_BW20_BITMAP_1) +
++ ARRAY_SIZE(bw160_5g_freq);
++ dev->dpd_chan_num_6g = hweight32(DPD_6G_CH_BW20_BITMAP_0) +
++ hweight32(DPD_6G_CH_BW20_BITMAP_1) +
++ ARRAY_SIZE(bw160_6g_freq);
++ dpd_size = MT_EE_CAL_DPD_SIZE_V2;
++ offs = MT_EE_DO_PRE_CAL_V2;
++ }
++ size = group_size + dpd_size;
++
++ switch (state) {
++ case MT76_TM_STATE_DPD_2G:
++ if (!is_set) {
++ func_data = cpu_to_le32(RF_DPD_FLAT_CAL);
++ dpd_ch_bw20_bitmap[0] = DPD_2G_CH_BW20_BITMAP_0;
++ bw20_ch = mphy->sband_2g.sband.channels;
++ bw160_freq = NULL;
++ bw160_size = 0;
++ band = NL80211_BAND_2GHZ;
++ do_precal = MT_EE_WIFI_CAL_DPD_2G;
++ is_set = true;
++ }
++ fallthrough;
++ case MT76_TM_STATE_DPD_5G:
++ if (!is_set) {
++ if (is_mt7915(&dev->mt76)) {
++ func_data = cpu_to_le32(RF_DPD_FLAT_CAL);
++ dpd_ch_bw20_bitmap[0] = DPD_5G_CH_BW20_BITMAP_7915_0;
++ bw160_size = 0;
++ dev->cur_prek_offset -= dev->dpd_chan_num_5g * MT_EE_CAL_UNIT * 2;
++ } else {
++ func_data = cpu_to_le32(RF_DPD_FLAT_5G_CAL);
++ dpd_ch_bw20_bitmap[0] = DPD_5G_CH_BW20_BITMAP_0;
++ dpd_ch_bw20_bitmap[1] = DPD_5G_CH_BW20_BITMAP_1;
++ bw160_size = ARRAY_SIZE(bw160_5g_freq);
++ }
++ bw20_ch = mphy->sband_5g.sband.channels;
++ bw160_freq = bw160_5g_freq;
++ band = NL80211_BAND_5GHZ;
++ do_precal = MT_EE_WIFI_CAL_DPD_5G;
++ is_set = true;
++ }
++ fallthrough;
++ case MT76_TM_STATE_DPD_6G:
++ if (!is_set) {
++ func_data = cpu_to_le32(RF_DPD_FLAT_6G_CAL);
++ dpd_ch_bw20_bitmap[0] = DPD_6G_CH_BW20_BITMAP_0;
++ dpd_ch_bw20_bitmap[1] = DPD_6G_CH_BW20_BITMAP_1;
++ bw20_ch = mphy->sband_6g.sband.channels;
++ bw160_freq = bw160_6g_freq;
++ bw160_size = ARRAY_SIZE(bw160_6g_freq);
++ band = NL80211_BAND_6GHZ;
++ do_precal = MT_EE_WIFI_CAL_DPD_6G;
++ is_set = true;
++ }
++
++ if (!bw20_ch)
++ return -EOPNOTSUPP;
++ if (!dev->cal) {
++ dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
++ if (!dev->cal)
++ return -ENOMEM;
++ }
++
++ req.op.rf.param.cal_param.func_data = func_data;
++ req.op.rf.param.cal_param.band_idx = phy->band_idx;
++
++ memcpy(&chan_backup, chandef->chan, sizeof(struct ieee80211_channel));
++ memcpy(&chandef_backup, chandef, sizeof(struct cfg80211_chan_def));
++
++ bw20_size = hweight32(dpd_ch_bw20_bitmap[0]) + hweight32(dpd_ch_bw20_bitmap[1]);
++ for (i = 0, j = 0; i < bw20_size + bw160_size; i++) {
++ if (i < bw20_size) {
++ freq = dpd_ch_bw20_bitmap[0] ? 0 : 1;
++ shift = ffs(dpd_ch_bw20_bitmap[freq]);
++ j += shift;
++ memcpy(&chan, &bw20_ch[j - 1], sizeof(struct ieee80211_channel));
++ chandef->width = NL80211_CHAN_WIDTH_20;
++ dpd_ch_bw20_bitmap[0] >>= shift;
++ } else {
++ freq = bw160_freq[i - bw20_size];
++ chan.center_freq = freq;
++ chan.hw_value = ieee80211_frequency_to_channel(freq);
++ chan.band = band;
++ chandef->width = NL80211_CHAN_WIDTH_160;
++ }
++
++ memcpy(chandef->chan, &chan, sizeof(struct ieee80211_channel));
++ if (is_mt7915(&dev->mt76))
++ mphy->hw->conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;
++ else
++ mphy->hw->conf.flags |= IEEE80211_CONF_OFFCHANNEL;
++
++ mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(CHANNEL_SWITCH));
++
++ ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_TEST), &req,
++ sizeof(req), true);
++ if (ret) {
++ dev_err(dev->mt76.dev, "DPD Pre-cal: mcu send msg failed!\n");
++ break;
++ }
++ }
++ memcpy(chandef, &chandef_backup, sizeof(struct cfg80211_chan_def));
++ memcpy(chandef->chan, &chan_backup, sizeof(struct ieee80211_channel));
++ mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(CHANNEL_SWITCH));
++
++ if (!ret)
++ eeprom[offs] |= do_precal;
++
++ break;
++ case MT76_TM_STATE_DPD_DUMP:
++ pre_cal = (u32 *)dev->cal;
++ if (!dev->cal) {
++ dev_info(dev->mt76.dev, "Not DPD pre-cal yet!\n");
++ return ret;
++ }
++ dev_info(dev->mt76.dev, "DPD Pre-Cal:\n");
++ for (i = 0; i < dpd_size / sizeof(u32); i += 4) {
++ j = i + (group_size / sizeof(u32));
++ dev_info(dev->mt76.dev, "[0x%08x] 0x%8x 0x%8x 0x%8x 0x%8x\n",
++ j * sizeof(u32), pre_cal[j], pre_cal[j + 1],
++ pre_cal[j + 2], pre_cal[j + 3]);
++ }
++ break;
++ case MT76_TM_STATE_DPD_CLEAN:
++ pre_cal = (u32 *)dev->cal;
++ if (!pre_cal)
++ return ret;
++ memset(pre_cal + (group_size / sizeof(u32)), 0, dpd_size);
++ do_precal = MT_EE_WIFI_CAL_DPD;
++ eeprom[offs] &= ~do_precal;
++ break;
++ default:
++ return -EINVAL;
++ }
++ return ret;
++}
++
++void mt7915_tm_re_cal_event(struct mt7915_dev *dev, struct mt7915_tm_rf_test_result *result,
++ struct mt7915_tm_rf_test_data *data)
++{
++#define DPD_PER_CHAN_SIZE_7915 2
++#define DPD_PER_CHAN_SIZE_7986 3
++ u32 base, dpd_offest_2g, dpd_offest_5g, cal_idx = 0, cal_type = 0, len = 0;
++ u8 *pre_cal;
++
++ pre_cal = dev->cal;
++ dpd_offest_5g = dev->dpd_chan_num_6g * DPD_PER_CHAN_SIZE_7986 * MT_EE_CAL_UNIT;
++ dpd_offest_2g = dpd_offest_5g + dev->dpd_chan_num_5g * MT_EE_CAL_UNIT *
++ (is_mt7915(&dev->mt76) ? DPD_PER_CHAN_SIZE_7915 : DPD_PER_CHAN_SIZE_7986);
++ cal_idx = le32_to_cpu(data->cal_idx);
++ cal_type = le32_to_cpu(data->cal_type);
++ len = le32_to_cpu(result->payload_len);
++ len = len - sizeof(struct mt7915_tm_rf_test_data);
++
++ switch (cal_type) {
++ case RF_PRE_CAL:
++ base = 0;
++ break;
++ case RF_DPD_FLAT_CAL:
++ base = mt7915_get_cal_group_size(dev) + dpd_offest_2g;
++ break;
++ case RF_DPD_FLAT_5G_CAL:
++ base = mt7915_get_cal_group_size(dev) + dpd_offest_5g;
++ break;
++ case RF_DPD_FLAT_6G_CAL:
++ base = mt7915_get_cal_group_size(dev);
++ break;
++ default:
++ dev_info(dev->mt76.dev, "Unknown calibration type!\n");
++ return;
++ }
++ pre_cal += (base + dev->cur_prek_offset);
++
++ memcpy(pre_cal, data->data, len);
++ dev->cur_prek_offset += len;
++}
++
++void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb)
++{
++ struct mt7915_tm_rf_test_result *result;
++ struct mt7915_tm_rf_test_data *data;
++ static u32 event_type;
++
++ result = (struct mt7915_tm_rf_test_result *)skb->data;
++ data = (struct mt7915_tm_rf_test_data *)result->event;
++
++ event_type = le32_to_cpu(result->func_idx);
++
++ switch (event_type) {
++ case RF_TEST_RE_CAL:
++ mt7915_tm_re_cal_event(dev, result, data);
++ break;
++ default:
++ break;
++ }
++}
++
+ static void
+ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+ {
+@@ -1712,6 +2021,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+ else if (prev_state == MT76_TM_STATE_OFF ||
+ state == MT76_TM_STATE_OFF)
+ mt7915_tm_init(phy, !(state == MT76_TM_STATE_OFF));
++ else if (state >= MT76_TM_STATE_GROUP_PREK && state <= MT76_TM_STATE_GROUP_PREK_CLEAN)
++ return mt7915_tm_group_prek(phy, state);
++ else if (state >= MT76_TM_STATE_DPD_2G && state <= MT76_TM_STATE_DPD_CLEAN)
++ return mt7915_tm_dpd_prek(phy, state);
+
+ if ((state == MT76_TM_STATE_IDLE &&
+ prev_state == MT76_TM_STATE_OFF) ||
+@@ -1873,9 +2186,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
+ return ret;
+ }
+
++static int
++mt7915_tm_dump_precal(struct mt76_phy *mphy, struct sk_buff *msg, int flag, int type)
++{
++#define DPD_PER_CHAN_SIZE_MASK GENMASK(31, 24)
++#define DPD_CHAN_NUM_2G_MASK GENMASK(23, 16)
++#define DPD_CHAN_NUM_5G_MASK GENMASK(15, 8)
++#define DPD_CHAN_NUM_6G_MASK GENMASK(7, 0)
++ struct mt7915_phy *phy = mphy->priv;
++ struct mt7915_dev *dev = phy->dev;
++ u32 i, group_size, dpd_size, total_size, dpd_per_chan_size, dpd_info = 0;
++ u32 base, size, total_chan_num, offs, transmit_size = 1000;
++ u8 *pre_cal, *eeprom;
++ void *precal;
++ enum prek_ops {
++ PREK_GET_INFO,
++ PREK_SYNC_ALL,
++ PREK_SYNC_GROUP,
++ PREK_SYNC_DPD_2G,
++ PREK_SYNC_DPD_5G,
++ PREK_SYNC_DPD_6G,
++ PREK_CLEAN_GROUP,
++ PREK_CLEAN_DPD,
++ };
++
++ if (!dev->cal) {
++ dev_info(dev->mt76.dev, "Not pre-cal yet!\n");
++ return 0;
++ }
++
++ group_size = mt7915_get_cal_group_size(dev);
++ dpd_size = is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2;
++ dpd_per_chan_size = is_mt7915(&dev->mt76) ? 2 : 3;
++ total_size = group_size + dpd_size;
++ pre_cal = dev->cal;
++ eeprom = dev->mt76.eeprom.data;
++ offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
++
++ total_chan_num = dev->dpd_chan_num_2g + dev->dpd_chan_num_5g + dev->dpd_chan_num_6g;
++
++ switch (type) {
++ case PREK_SYNC_ALL:
++ base = 0;
++ size = total_size;
++ break;
++ case PREK_SYNC_GROUP:
++ base = 0;
++ size = group_size;
++ break;
++ case PREK_SYNC_DPD_6G:
++ base = group_size;
++ size = dpd_size * dev->dpd_chan_num_6g / total_chan_num;
++ break;
++ case PREK_SYNC_DPD_5G:
++ base = group_size + dev->dpd_chan_num_6g * dpd_per_chan_size * MT_EE_CAL_UNIT;
++ size = dpd_size * dev->dpd_chan_num_5g / total_chan_num;
++ break;
++ case PREK_SYNC_DPD_2G:
++ base = group_size + (dev->dpd_chan_num_6g + dev->dpd_chan_num_5g) *
++ dpd_per_chan_size * MT_EE_CAL_UNIT;
++ size = dpd_size * dev->dpd_chan_num_2g / total_chan_num;
++ break;
++ case PREK_GET_INFO:
++ break;
++ default:
++ return 0;
++ }
++
++ if (!flag) {
++ if (eeprom[offs] & MT_EE_WIFI_CAL_DPD) {
++ dpd_info |= u32_encode_bits(dpd_per_chan_size, DPD_PER_CHAN_SIZE_MASK) |
++ u32_encode_bits(dev->dpd_chan_num_2g, DPD_CHAN_NUM_2G_MASK) |
++ u32_encode_bits(dev->dpd_chan_num_5g, DPD_CHAN_NUM_5G_MASK) |
++ u32_encode_bits(dev->dpd_chan_num_6g, DPD_CHAN_NUM_6G_MASK);
++ }
++ dev->cur_prek_offset = 0;
++ precal = nla_nest_start(msg, MT76_TM_ATTR_PRECAL_INFO);
++ if (!precal)
++ return -ENOMEM;
++ nla_put_u32(msg, 0, group_size);
++ nla_put_u32(msg, 1, dpd_size);
++ nla_put_u32(msg, 2, dpd_info);
++ nla_put_u32(msg, 3, transmit_size);
++ nla_put_u32(msg, 4, eeprom[offs]);
++ nla_nest_end(msg, precal);
++ } else {
++ precal = nla_nest_start(msg, MT76_TM_ATTR_PRECAL);
++ if (!precal)
++ return -ENOMEM;
++
++ transmit_size = (dev->cur_prek_offset + transmit_size < size) ?
++ transmit_size : (size - dev->cur_prek_offset);
++ for (i = 0; i < transmit_size; i++) {
++ if (nla_put_u8(msg, i, pre_cal[base + dev->cur_prek_offset + i]))
++ return -ENOMEM;
++ }
++ dev->cur_prek_offset += transmit_size;
++
++ nla_nest_end(msg, precal);
++ }
++
++ return 0;
++}
++
+ const struct mt76_testmode_ops mt7915_testmode_ops = {
+ .set_state = mt7915_tm_set_state,
+ .set_params = mt7915_tm_set_params,
+ .dump_stats = mt7915_tm_dump_stats,
+ .set_eeprom = mt7915_tm_set_eeprom,
++ .dump_precal = mt7915_tm_dump_precal,
+ };
+diff --git a/mt7915/testmode.h b/mt7915/testmode.h
+index 01b08e9e..d500987d 100644
+--- a/mt7915/testmode.h
++++ b/mt7915/testmode.h
+@@ -81,6 +81,11 @@ struct tm_tx_cont {
+ u8 txfd_mode;
+ };
+
++struct tm_cal_param {
++ __le32 func_data;
++ u8 band_idx;
++};
++
+ struct mt7915_tm_rf_test {
+ u8 action;
+ u8 icap_len;
+@@ -96,6 +101,7 @@ struct mt7915_tm_rf_test {
+ __le32 cal_dump;
+
+ struct tm_tx_cont tx_cont;
++ struct tm_cal_param cal_param;
+
+ u8 _pad[80];
+ } param;
+@@ -103,6 +109,20 @@ struct mt7915_tm_rf_test {
+ } op;
+ } __packed;
+
++struct mt7915_tm_rf_test_result {
++ struct mt76_connac2_mcu_rxd rxd;
++
++ u32 func_idx;
++ u32 payload_len;
++ u8 event[0];
++} __packed;
++
++struct mt7915_tm_rf_test_data {
++ u32 cal_idx;
++ u32 cal_type;
++ u8 data[0];
++} __packed;
++
+ enum {
+ RF_OPER_NORMAL,
+ RF_OPER_RF_TEST,
+@@ -111,6 +131,22 @@ enum {
+ RF_OPER_WIFI_SPECTRUM,
+ };
+
++enum {
++ RF_ACT_SWITCH_MODE,
++ RF_ACT_IN_RFTEST,
++};
++
++enum {
++ RF_TEST_RE_CAL = 0x01,
++ RF_TEST_TX_CONT_START = 0x05,
++ RF_TEST_TX_CONT_STOP = 0x06,
++};
++
++#define RF_DPD_FLAT_CAL BIT(28)
++#define RF_PRE_CAL BIT(29)
++#define RF_DPD_FLAT_5G_CAL GENMASK(29, 28)
++#define RF_DPD_FLAT_6G_CAL (BIT(30) | BIT(28))
++
+ enum {
+ TAM_ARB_OP_MODE_NORMAL = 1,
+ TAM_ARB_OP_MODE_TEST,
+diff --git a/testmode.c b/testmode.c
+index 7a9ed543..82b8e983 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -763,6 +763,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+
+ mutex_lock(&dev->mutex);
+
++ if (tb[MT76_TM_ATTR_PRECAL] || tb[MT76_TM_ATTR_PRECAL_INFO]) {
++ int flag, type;
++
++ err = -EINVAL;
++ flag = tb[MT76_TM_ATTR_PRECAL] ? 1 : 0;
++ type = flag ? nla_get_u8(tb[MT76_TM_ATTR_PRECAL_INFO]) : 0;
++ if (dev->test_ops->dump_precal)
++ err = dev->test_ops->dump_precal(phy, msg, flag, type);
++
++ goto out;
++ }
++
+ if (tb[MT76_TM_ATTR_STATS]) {
+ err = -EINVAL;
+
+@@ -796,7 +808,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+
+ if (dev->test_mtd.name &&
+ (nla_put_string(msg, MT76_TM_ATTR_MTD_PART, dev->test_mtd.name) ||
+- nla_put_u32(msg, MT76_TM_ATTR_MTD_OFFSET, dev->test_mtd.offset)))
++ nla_put_u32(msg, MT76_TM_ATTR_MTD_OFFSET, dev->test_mtd.offset) ||
++ nla_put_u8(msg, MT76_TM_ATTR_IS_MAIN_PHY, phy == &dev->phy)))
+ goto out;
+
+ if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
+diff --git a/testmode.h b/testmode.h
+index 57949f2b..e2190e72 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -19,6 +19,7 @@
+ *
+ * @MT76_TM_ATTR_MTD_PART: mtd partition used for eeprom data (string)
+ * @MT76_TM_ATTR_MTD_OFFSET: offset of eeprom data within the partition (u32)
++ * @MT76_TM_ATTR_IS_MAIN_PHY: Is current phy index the main phy or the ext phy (u8)
+ *
+ * @MT76_TM_ATTR_TX_COUNT: configured number of frames to send when setting
+ * state to MT76_TM_STATE_TX_FRAMES (u32)
+@@ -40,6 +41,11 @@
+ *
+ * @MT76_TM_ATTR_STATS: statistics (nested, see &enum mt76_testmode_stats_attr)
+ *
++ * @MT76_TM_ATTR_PRECAL: Pre-cal data (u8)
++ * @MT76_TM_ATTR_PRECAL_INFO: group size, dpd size, dpd_info, transmit size,
++ * eeprom cal indicator (u32),
++ * dpd_info = [dpd_per_chan_size, chan_num_2g,
++ * chan_num_5g, chan_num_6g]
+ * @MT76_TM_ATTR_TX_SPE_IDX: tx spatial extension index (u8)
+ *
+ * @MT76_TM_ATTR_TX_DUTY_CYCLE: packet tx duty cycle (u8)
+@@ -67,6 +73,7 @@ enum mt76_testmode_attr {
+
+ MT76_TM_ATTR_MTD_PART,
+ MT76_TM_ATTR_MTD_OFFSET,
++ MT76_TM_ATTR_IS_MAIN_PHY,
+
+ MT76_TM_ATTR_TX_COUNT,
+ MT76_TM_ATTR_TX_LENGTH,
+@@ -85,6 +92,8 @@ enum mt76_testmode_attr {
+ MT76_TM_ATTR_FREQ_OFFSET,
+
+ MT76_TM_ATTR_STATS,
++ MT76_TM_ATTR_PRECAL,
++ MT76_TM_ATTR_PRECAL_INFO,
+
+ MT76_TM_ATTR_TX_SPE_IDX,
+
+@@ -184,6 +193,14 @@ enum mt76_testmode_state {
+ MT76_TM_STATE_TX_FRAMES,
+ MT76_TM_STATE_RX_FRAMES,
+ MT76_TM_STATE_TX_CONT,
++ MT76_TM_STATE_GROUP_PREK,
++ MT76_TM_STATE_GROUP_PREK_DUMP,
++ MT76_TM_STATE_GROUP_PREK_CLEAN,
++ MT76_TM_STATE_DPD_2G,
++ MT76_TM_STATE_DPD_5G,
++ MT76_TM_STATE_DPD_6G,
++ MT76_TM_STATE_DPD_DUMP,
++ MT76_TM_STATE_DPD_CLEAN,
+ MT76_TM_STATE_ON,
+
+ /* keep last */
+diff --git a/tools/fields.c b/tools/fields.c
+index 6e36ab27..1be1ffd6 100644
+--- a/tools/fields.c
++++ b/tools/fields.c
+@@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
+ [MT76_TM_STATE_TX_FRAMES] = "tx_frames",
+ [MT76_TM_STATE_RX_FRAMES] = "rx_frames",
+ [MT76_TM_STATE_TX_CONT] = "tx_cont",
++ [MT76_TM_STATE_GROUP_PREK] = "group_prek",
++ [MT76_TM_STATE_GROUP_PREK_DUMP] = "group_prek_dump",
++ [MT76_TM_STATE_GROUP_PREK_CLEAN] = "group_prek_clean",
++ [MT76_TM_STATE_DPD_2G] = "dpd_2g",
++ [MT76_TM_STATE_DPD_5G] = "dpd_5g",
++ [MT76_TM_STATE_DPD_6G] = "dpd_6g",
++ [MT76_TM_STATE_DPD_DUMP] = "dpd_dump",
++ [MT76_TM_STATE_DPD_CLEAN] = "dpd_clean",
+ };
+
+ static const char * const testmode_tx_mode[] = {
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
new file mode 100644
index 0000000..d37122d
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
@@ -0,0 +1,243 @@
+From 872894745f05c7fb7c2928cd6bd8395af47933c1 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 12 Sep 2022 18:16:54 +0800
+Subject: [PATCH 1114/1128] mt76: testmode: add iBF command mode support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: I7eea1d6412563f889e5774e787e58ce9eba001bd
+---
+ mt7915/testmode.c | 21 ++++++++++++++-------
+ testmode.c | 41 +++++++++++++++++++++++++++++++++++++++++
+ testmode.h | 2 ++
+ tools/fields.c | 28 ++++++++++++++++++++++++++++
+ 4 files changed, 85 insertions(+), 7 deletions(-)
+
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index c6a5837e..9de11e98 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ struct ieee80211_vif *vif = phy->monitor_vif;
+ struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
+ u8 pfmu_idx = val[0], nc = val[2], nr;
++ bool is_atenl = val[6];
+ int ret;
+
+ if (td->tx_antenna_mask == 3)
+@@ -748,7 +749,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ if (ret)
+ return ret;
+
+- if (!ebf)
++ if (!ebf && is_atenl)
+ return mt7915_tm_txbf_apply_tx(phy, 1, false, true, true);
+
+ return 0;
+@@ -775,7 +776,7 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+ .group_l_m_n = val[1],
+ .sx2 = val[2],
+ .cal_type = val[3],
+- .lna_gain_level = 0, /* for test purpose */
++ .lna_gain_level = val[4],
+ };
+ struct mt7915_tm_txbf_phase *phase =
+ (struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
+@@ -814,6 +815,8 @@ int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
+ phase = &phase[cal->group];
+ memcpy(&phase->phase, cal->buf + 16, sizeof(phase->phase));
+ phase->status = cal->status;
++ /* for passing iTest script */
++ dev_info(dev->mt76.dev, "Calibrated result = %d\n", phase->status);
+ break;
+ case IBF_PHASE_CAL_VERIFY:
+ case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
+@@ -865,7 +868,6 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ pfmu_data->phi11 = cpu_to_le16(phi11);
+ pfmu_data->phi21 = cpu_to_le16(phi21);
+ pfmu_data->phi31 = cpu_to_le16(phi31);
+-
+ if (subc_id == 63) {
+ struct mt7915_dev *dev = phy->dev;
+ struct {
+@@ -923,8 +925,8 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+ struct mt76_testmode_data *td = &phy->mt76->test;
+ u16 *val = td->txbf_param;
+
+- pr_info("ibf cal process: act = %u, val = %u, %u, %u, %u, %u\n",
+- td->txbf_act, val[0], val[1], val[2], val[3], val[4]);
++ pr_info("ibf cal process: act = %u, val = %u, %u, %u, %u, %u, %u\n",
++ td->txbf_act, val[0], val[1], val[2], val[3], val[4], val[5]);
+
+ switch (td->txbf_act) {
+ case MT76_TM_TXBF_ACT_INIT:
+@@ -942,10 +944,17 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+ return mt7915_tm_txbf_profile_update(phy, val, true);
+ case MT76_TM_TXBF_ACT_PHASE_CAL:
+ return mt7915_tm_txbf_phase_cal(phy, val);
++ case MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD:
+ case MT76_TM_TXBF_ACT_PROF_UPDATE_ALL:
+ return mt7915_tm_txbf_profile_update_all(phy, val);
+ case MT76_TM_TXBF_ACT_E2P_UPDATE:
+ return mt7915_tm_txbf_e2p_update(phy);
++ case MT76_TM_TXBF_ACT_APPLY_TX: {
++ u16 wlan_idx = val[0];
++ bool ebf = !!val[1], ibf = !!val[2], phase_cal = !!val[4];
++
++ return mt7915_tm_txbf_apply_tx(phy, wlan_idx, ebf, ibf, phase_cal);
++ }
+ default:
+ break;
+ };
+@@ -1071,7 +1080,6 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
+ rate.legacy = sband->bitrates[rate.mcs].bitrate;
+ break;
+ case MT76_TM_TX_MODE_HT:
+- rate.mcs += rate.nss * 8;
+ flags |= RATE_INFO_FLAGS_MCS;
+
+ if (td->tx_rate_sgi)
+@@ -1435,7 +1443,6 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ if (duty_cycle < 100)
+ tx_time = duty_cycle * ipg / (100 - duty_cycle);
+ }
+-
+ mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
+ mt7915_tm_set_tx_len(phy, tx_time);
+
+diff --git a/testmode.c b/testmode.c
+index 82b8e983..aa874a83 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -530,6 +530,42 @@ out:
+ return err;
+ }
+
++static int
++mt76_testmode_txbf_profile_update_all_cmd(struct mt76_phy *phy, struct nlattr **tb, u32 state)
++{
++#define PARAM_UNIT 5
++ static u8 pfmu_idx;
++ struct mt76_testmode_data *td = &phy->test;
++ struct mt76_dev *dev = phy->dev;
++ struct nlattr *cur;
++ u16 tmp_val[PARAM_UNIT], *val = td->txbf_param;
++ int idx, rem, ret, i = 0;
++
++ memset(td->txbf_param, 0, sizeof(td->txbf_param));
++ nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
++ if (nla_len(cur) != 2)
++ return -EINVAL;
++ idx = i % PARAM_UNIT;
++ tmp_val[idx] = nla_get_u16(cur);
++ if (idx == 1 && (tmp_val[idx] == 0xf0 || tmp_val[idx] == 0xff)) {
++ pfmu_idx = tmp_val[0];
++ return 0;
++ }
++ if (idx == PARAM_UNIT - 1) {
++ val[0] = pfmu_idx;
++ memcpy(val + 1, tmp_val, sizeof(tmp_val));
++ if (dev->test_ops->set_params) {
++ ret = dev->test_ops->set_params(phy, tb, state);
++ if (ret)
++ return ret;
++ }
++ }
++ i++;
++ }
++
++ return 0;
++}
++
+ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ void *data, int len)
+ {
+@@ -668,6 +704,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 0, MT76_TM_TXBF_ACT_MAX))
+ goto out;
+
++ if (td->txbf_act == MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD) {
++ err = mt76_testmode_txbf_profile_update_all_cmd(phy, tb, state);
++ goto out;
++ }
++
+ memset(td->txbf_param, 0, sizeof(td->txbf_param));
+ nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
+ if (nla_len(cur) != 2 ||
+diff --git a/testmode.h b/testmode.h
+index e2190e72..5d1fe793 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -281,8 +281,10 @@ enum mt76_testmode_txbf_act {
+ MT76_TM_TXBF_ACT_TX_PREP,
+ MT76_TM_TXBF_ACT_IBF_PROF_UPDATE,
+ MT76_TM_TXBF_ACT_EBF_PROF_UPDATE,
++ MT76_TM_TXBF_ACT_APPLY_TX,
+ MT76_TM_TXBF_ACT_PHASE_CAL,
+ MT76_TM_TXBF_ACT_PROF_UPDATE_ALL,
++ MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD,
+ MT76_TM_TXBF_ACT_E2P_UPDATE,
+
+ /* keep last */
+diff --git a/tools/fields.c b/tools/fields.c
+index 1be1ffd6..47fc69f9 100644
+--- a/tools/fields.c
++++ b/tools/fields.c
+@@ -32,6 +32,20 @@ static const char * const testmode_tx_mode[] = {
+ [MT76_TM_TX_MODE_HE_MU] = "he_mu",
+ };
+
++static const char * const testmode_txbf_act[] = {
++ [MT76_TM_TXBF_ACT_INIT] = "init",
++ [MT76_TM_TXBF_ACT_UPDATE_CH] = "update_ch",
++ [MT76_TM_TXBF_ACT_PHASE_COMP] = "phase_comp",
++ [MT76_TM_TXBF_ACT_TX_PREP] = "tx_prep",
++ [MT76_TM_TXBF_ACT_IBF_PROF_UPDATE] = "ibf_prof_update",
++ [MT76_TM_TXBF_ACT_EBF_PROF_UPDATE] = "ebf_prof_update",
++ [MT76_TM_TXBF_ACT_APPLY_TX] = "apply_tx",
++ [MT76_TM_TXBF_ACT_PHASE_CAL] = "phase_cal",
++ [MT76_TM_TXBF_ACT_PROF_UPDATE_ALL] = "prof_update",
++ [MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD] = "prof_update_all",
++ [MT76_TM_TXBF_ACT_E2P_UPDATE] = "e2p_update",
++};
++
+ static void print_enum(const struct tm_field *field, struct nlattr *attr)
+ {
+ unsigned int i = nla_get_u8(attr);
+@@ -82,6 +96,17 @@ static void print_s8(const struct tm_field *field, struct nlattr *attr)
+ printf("%d", (int8_t)nla_get_u8(attr));
+ }
+
++static bool parse_u16_hex(const struct tm_field *field, int idx,
++ struct nl_msg *msg, const char *val)
++{
++ return !nla_put_u16(msg, idx, strtoul(val, NULL, 16));
++}
++
++static void print_u16_hex(const struct tm_field *field, struct nlattr *attr)
++{
++ printf("%d", nla_get_u16(attr));
++}
++
+ static bool parse_u32(const struct tm_field *field, int idx,
+ struct nl_msg *msg, const char *val)
+ {
+@@ -384,6 +409,8 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
+ FIELD(u8, AID, "aid"),
+ FIELD(u8, RU_ALLOC, "ru_alloc"),
+ FIELD(u8, RU_IDX, "ru_idx"),
++ FIELD_ENUM(TXBF_ACT, "txbf_act", testmode_txbf_act),
++ FIELD_ARRAY(u16_hex, TXBF_PARAM, "txbf_param"),
+ FIELD_MAC(MAC_ADDRS, "mac_addrs"),
+ FIELD_NESTED_RO(STATS, stats, "",
+ .print_extra = print_extra_stats),
+@@ -414,6 +441,7 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
+ [MT76_TM_ATTR_RU_ALLOC] = { .type = NLA_U8 },
+ [MT76_TM_ATTR_RU_IDX] = { .type = NLA_U8 },
+ [MT76_TM_ATTR_STATS] = { .type = NLA_NESTED },
++ [MT76_TM_ATTR_TXBF_ACT] = { .type = NLA_U8 },
+ };
+
+ const struct tm_field msg_field = {
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
new file mode 100644
index 0000000..5b05b06
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -0,0 +1,686 @@
+From 189f75c624438287c7228eb029f07e7a79cbccff Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 27 Oct 2022 17:42:07 +0800
+Subject: [PATCH 1115/1128] mt76: testmode: add ZWDFS test mode support
+
+Change-Id: I14d104b7158a35acf6b0595357d07fb87f5a9d94
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt76.h | 9 ++
+ mt76_connac_mcu.h | 2 +
+ mt7915/mcu.c | 66 +++++++++++++
+ mt7915/mcu.h | 46 +++++++++
+ mt7915/mt7915.h | 4 +
+ mt7915/regs.h | 2 +
+ mt7915/testmode.c | 232 ++++++++++++++++++++++++++++++++++++++++++++++
+ testmode.c | 25 ++++-
+ testmode.h | 45 +++++++++
+ tools/fields.c | 22 +++++
+ 10 files changed, 452 insertions(+), 1 deletion(-)
+
+diff --git a/mt76.h b/mt76.h
+index 2beb1056..8139b4ad 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -719,6 +719,15 @@ struct mt76_testmode_data {
+ u64 fcs_error[__MT_RXQ_MAX];
+ u64 len_mismatch;
+ } rx_stats;
++
++ u8 offchan_ch;
++ u8 offchan_center_ch;
++ u8 offchan_bw;
++
++ u8 ipi_threshold;
++ u32 ipi_period;
++ u8 ipi_antenna_idx;
++ u8 ipi_reset;
+ };
+
+ struct mt76_vif {
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 4e489244..c353341e 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1179,6 +1179,7 @@ enum {
+ MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
+ MCU_EXT_CMD_SET_RDD_TH = 0x9d,
+ MCU_EXT_CMD_MURU_CTRL = 0x9f,
++ MCU_EXT_CMD_IPI_HIST_CTRL = 0xa3,
+ MCU_EXT_CMD_RX_STAT = 0xa4,
+ MCU_EXT_CMD_SET_SPR = 0xa8,
+ MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
+@@ -1189,6 +1190,7 @@ enum {
+ MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
+ MCU_EXT_CMD_CERT_CFG = 0xb7,
+ MCU_EXT_CMD_CSI_CTRL = 0xc2,
++ MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
+ };
+
+ enum {
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index d1ff73a9..51ec151b 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2620,6 +2620,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
+ req.monitor_chan = chandef->chan->hw_value;
+ req.monitor_central_chan =
+ ieee80211_frequency_to_channel(chandef->center_freq1);
++ req.monitor_bw = mt76_connac_chan_bw(chandef);
+ req.band_idx = phy->band_idx;
+ req.scan_mode = 2;
+ break;
+@@ -4450,3 +4451,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
+ }
+ #endif
++
++int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct sk_buff *skb;
++ int ret;
++ struct {
++ u8 ipi_hist_idx;
++ u8 band_idx;
++ u8 set_val;
++ u8 rsv;
++ int idle_power_th;
++ u32 idle_power_max_cnt;
++ u32 idle_power_duration;
++ u32 idle_power_cmd_type;
++ } __packed req = {
++ .ipi_hist_idx = cmd,
++ .band_idx = phy->band_idx,
++ };
++
++ if (!wait_resp)
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(IPI_HIST_CTRL),
++ &req, sizeof(req), true);
++
++ ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(IPI_HIST_CTRL),
++ &req, sizeof(req), wait_resp, &skb);
++
++ if (ret)
++ return ret;
++
++ memcpy(data, skb->data, sizeof(struct mt7915_mcu_rdd_ipi_ctrl));
++ dev_kfree_skb(skb);
++
++ return 0;
++}
++
++int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct sk_buff *skb;
++ int ret;
++ struct rdd_ipi_hist_scan {
++ u8 mode;
++ u8 pd_setting;
++ u8 band_idx;
++ u8 rsv;
++ } __packed req = {
++ .mode = mode,
++ .pd_setting = 1,
++ .band_idx = phy->band_idx,
++ };
++
++ ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(IPI_HIST_SCAN),
++ &req, sizeof(req), wait_resp, &skb);
++ if (ret)
++ return ret;
++
++ if (!wait_resp)
++ return 0;
++
++ memcpy(data, skb->data, sizeof(struct mt7915_mcu_rdd_ipi_scan));
++ dev_kfree_skb(skb);
++
++ return 0;
++}
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 4bc58c98..300b7834 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -609,6 +609,52 @@ struct csi_data {
+ };
+ #endif
+
++enum {
++ RDD_SET_IPI_CR_INIT, /* CR initialization */
++ RDD_SET_IPI_HIST_RESET, /* Reset IPI histogram counter */
++ RDD_SET_IDLE_POWER, /* Idle power info */
++ RDD_SET_IPI_HIST_NUM
++};
++
++enum {
++ RDD_IPI_HIST_0, /* IPI count for power <= -92 (dBm) */
++ RDD_IPI_HIST_1, /* IPI count for -92 < power <= -89 (dBm) */
++ RDD_IPI_HIST_2, /* IPI count for -89 < power <= -86 (dBm) */
++ RDD_IPI_HIST_3, /* IPI count for -86 < power <= -83 (dBm) */
++ RDD_IPI_HIST_4, /* IPI count for -83 < power <= -80 (dBm) */
++ RDD_IPI_HIST_5, /* IPI count for -80 < power <= -75 (dBm) */
++ RDD_IPI_HIST_6, /* IPI count for -75 < power <= -70 (dBm) */
++ RDD_IPI_HIST_7, /* IPI count for -70 < power <= -65 (dBm) */
++ RDD_IPI_HIST_8, /* IPI count for -65 < power <= -60 (dBm) */
++ RDD_IPI_HIST_9, /* IPI count for -60 < power <= -55 (dBm) */
++ RDD_IPI_HIST_10, /* IPI count for -55 < power (dBm) */
++ RDD_IPI_FREE_RUN_CNT, /* IPI count for counter++ per 8 us */
++ RDD_IPI_HIST_ALL_CNT, /* Get all IPI */
++ RDD_IPI_HIST_0_TO_10_CNT, /* Get IPI histogram 0 to 10 */
++ RDD_IPI_HIST_2_TO_10_CNT, /* Get IPI histogram 2 to 10 */
++ RDD_TX_ASSERT_TIME, /* Get band 1 TX assert time */
++ RDD_IPI_HIST_NUM
++};
++
++#define RDM_NF_MAX_WF_IDX 8
++#define POWER_INDICATE_HIST_MAX RDD_IPI_FREE_RUN_CNT
++#define IPI_HIST_TYPE_NUM (POWER_INDICATE_HIST_MAX + 1)
++
++struct mt7915_mcu_rdd_ipi_ctrl {
++ u8 ipi_hist_idx;
++ u8 band_idx;
++ u8 rsv[2];
++ u32 ipi_hist_val[IPI_HIST_TYPE_NUM];
++ u32 tx_assert_time; /* unit: us */
++} __packed;
++
++struct mt7915_mcu_rdd_ipi_scan {
++ u32 ipi_hist_val[RDM_NF_MAX_WF_IDX][POWER_INDICATE_HIST_MAX];
++ u8 band_idx;
++ u8 rsv[2];
++ u8 tx_assert_time; /* unit: us */
++} __packed;
++
+ /* MURU */
+ #define OFDMA_DL BIT(0)
+ #define OFDMA_UL BIT(1)
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index cafd4389..0cbd02e2 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -304,6 +304,7 @@ struct mt7915_phy {
+
+ struct mib_stats mib;
+ struct mt76_channel_state state_ts;
++ struct delayed_work ipi_work;
+
+ #ifdef CONFIG_NL80211_TESTMODE
+ struct {
+@@ -753,6 +754,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+ struct ieee80211_sta *sta);
+ #endif
+
++int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
++int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
++
+ #ifdef MTK_DEBUG
+ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
+ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index ae4695ae..6aa98812 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -1187,6 +1187,8 @@ enum offs_rev {
+ #define MT_WF_IRPI_NSS(phy, nss) MT_WF_IRPI(0x6000 + ((phy) << 20) + ((nss) << 16))
+ #define MT_WF_IRPI_NSS_MT7916(phy, nss) MT_WF_IRPI(0x1000 + ((phy) << 20) + ((nss) << 16))
+
++#define MT_WF_IPI_RESET 0x831a3008
++
+ /* PHY */
+ #define MT_WF_PHY_BASE 0x83080000
+ #define MT_WF_PHY(ofs) (MT_WF_PHY_BASE + (ofs))
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 9de11e98..6ce2c0e6 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -13,6 +13,12 @@ enum {
+ TM_CHANGED_AID,
+ TM_CHANGED_CFG,
+ TM_CHANGED_TXBF_ACT,
++ TM_CHANGED_OFF_CHAN_CH,
++ TM_CHANGED_OFF_CHAN_CENTER_CH,
++ TM_CHANGED_OFF_CHAN_BW,
++ TM_CHANGED_IPI_THRESHOLD,
++ TM_CHANGED_IPI_PERIOD,
++ TM_CHANGED_IPI_RESET,
+
+ /* must be last */
+ NUM_TM_CHANGED
+@@ -24,6 +30,12 @@ static const u8 tm_change_map[] = {
+ [TM_CHANGED_AID] = MT76_TM_ATTR_AID,
+ [TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
+ [TM_CHANGED_TXBF_ACT] = MT76_TM_ATTR_TXBF_ACT,
++ [TM_CHANGED_OFF_CHAN_CH] = MT76_TM_ATTR_OFF_CH_SCAN_CH,
++ [TM_CHANGED_OFF_CHAN_CENTER_CH] = MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH,
++ [TM_CHANGED_OFF_CHAN_BW] = MT76_TM_ATTR_OFF_CH_SCAN_BW,
++ [TM_CHANGED_IPI_THRESHOLD] = MT76_TM_ATTR_IPI_THRESHOLD,
++ [TM_CHANGED_IPI_PERIOD] = MT76_TM_ATTR_IPI_PERIOD,
++ [TM_CHANGED_IPI_RESET] = MT76_TM_ATTR_IPI_RESET,
+ };
+
+ struct reg_band {
+@@ -962,6 +974,216 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+ return 0;
+ }
+
++static int
++mt7915_tm_set_offchan(struct mt7915_phy *phy)
++{
++ struct mt76_phy *mphy = phy->mt76;
++ struct mt7915_dev *dev = phy->dev;
++ struct ieee80211_hw *hw = mphy->hw;
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ struct cfg80211_chan_def chandef = {};
++ struct ieee80211_channel *chan;
++ int ret, freq = ieee80211_channel_to_frequency(td->offchan_ch, NL80211_BAND_5GHZ);
++ int width_mhz;
++ const int bw_to_mhz[] = {
++ [NL80211_CHAN_WIDTH_20_NOHT] = 20,
++ [NL80211_CHAN_WIDTH_20] = 20,
++ [NL80211_CHAN_WIDTH_40] = 40,
++ [NL80211_CHAN_WIDTH_80] = 80,
++ [NL80211_CHAN_WIDTH_80P80] = 80,
++ [NL80211_CHAN_WIDTH_160] = 160,
++ };
++
++ if (!mphy->cap.has_5ghz || !freq) {
++ ret = -EINVAL;
++ dev_info(dev->mt76.dev, "Failed to set offchan (invalid band or channel)!\n");
++ goto out;
++ }
++
++ chandef.width = td->offchan_bw;
++ width_mhz = bw_to_mhz[chandef.width];
++ chandef.center_freq1 = freq;
++ chan = ieee80211_get_channel(hw->wiphy, freq);
++ chandef.chan = chan;
++
++ memset(&dev->rdd2_chandef, 0, sizeof(struct cfg80211_chan_def));
++
++ ret = mt7915_mcu_rdd_background_enable(phy, &chandef);
++
++ if (ret)
++ goto out;
++
++ dev->rdd2_phy = phy;
++ dev->rdd2_chandef = chandef;
++
++ return ret;
++
++out:
++ td->offchan_ch = 0;
++ td->offchan_bw = 0;
++
++ return ret;
++}
++
++static void
++mt7915_tm_dump_ipi(struct mt7915_phy *phy, void *data, u8 antenna_num,
++ u8 start_antenna_idx, bool is_scan)
++{
++#define PRECISION 100
++ struct mt7915_dev *dev = phy->dev;
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ struct mt7915_mcu_rdd_ipi_scan *scan_data;
++ struct mt7915_mcu_rdd_ipi_ctrl *ctrl_data;
++ u32 ipi_idx, ipi_free_count, ipi_percentage, ipi_hist_count_th, ipi_hist_total_count;
++ u32 self_idle_ratio, ipi_idle_ratio, channel_load, tx_assert_time;
++ u8 i, antenna_idx = start_antenna_idx;
++ u32 *ipi_hist_data;
++ const char *power_lower_bound, *power_upper_bound;
++ static const char * const ipi_idx_to_power_bound[] = {
++ [RDD_IPI_HIST_0] = "-92",
++ [RDD_IPI_HIST_1] = "-89",
++ [RDD_IPI_HIST_2] = "-86",
++ [RDD_IPI_HIST_3] = "-83",
++ [RDD_IPI_HIST_4] = "-80",
++ [RDD_IPI_HIST_5] = "-75",
++ [RDD_IPI_HIST_6] = "-70",
++ [RDD_IPI_HIST_7] = "-65",
++ [RDD_IPI_HIST_8] = "-60",
++ [RDD_IPI_HIST_9] = "-55",
++ [RDD_IPI_HIST_10] = "inf",
++ };
++
++ if (is_scan) {
++ scan_data = (struct mt7915_mcu_rdd_ipi_scan *)data;
++ tx_assert_time = scan_data->tx_assert_time;
++ } else {
++ ctrl_data = (struct mt7915_mcu_rdd_ipi_ctrl *)data;
++ tx_assert_time = ctrl_data->tx_assert_time;
++ }
++
++ for (i = 0; i < antenna_num; i++) {
++ ipi_free_count = 0;
++ ipi_hist_count_th = 0;
++ ipi_hist_total_count = 0;
++ ipi_hist_data = is_scan ? scan_data->ipi_hist_val[antenna_idx] :
++ ctrl_data->ipi_hist_val;
++
++ dev_info(dev->mt76.dev, "Antenna index: %d\n", antenna_idx);
++ for (ipi_idx = 0; ipi_idx < POWER_INDICATE_HIST_MAX; ipi_idx++) {
++ power_lower_bound = ipi_idx ? ipi_idx_to_power_bound[ipi_idx - 1] :
++ "-inf";
++ power_upper_bound = ipi_idx_to_power_bound[ipi_idx];
++
++ dev_info(dev->mt76.dev,
++ "IPI %d (power range: (%s, %s] dBm): ipi count = %d\n",
++ ipi_idx, power_lower_bound,
++ power_upper_bound, ipi_hist_data[ipi_idx]);
++
++ if (td->ipi_threshold <= ipi_idx && ipi_idx <= RDD_IPI_HIST_10)
++ ipi_hist_count_th += ipi_hist_data[ipi_idx];
++
++ ipi_hist_total_count += ipi_hist_data[ipi_idx];
++ }
++ ipi_free_count = is_scan ? ipi_hist_total_count :
++ ipi_hist_data[RDD_IPI_FREE_RUN_CNT];
++
++ dev_info(dev->mt76.dev,
++ "IPI threshold %d: ipi_hist_count_th = %d, ipi_free_count = %d\n",
++ td->ipi_threshold, ipi_hist_count_th, ipi_free_count);
++ dev_info(dev->mt76.dev, "TX assert time = %d [ms]\n",
++ tx_assert_time / 1000);
++
++ // Calculate channel load = (self idle ratio - idle ratio) / self idle ratio
++ if (ipi_hist_count_th >= UINT_MAX / (100 * PRECISION))
++ ipi_percentage = 100 * PRECISION *
++ (ipi_hist_count_th / (100 * PRECISION)) /
++ (ipi_free_count / (100 * PRECISION));
++ else
++ ipi_percentage = PRECISION * 100 * ipi_hist_count_th / ipi_free_count;
++
++ ipi_idle_ratio = ((100 * PRECISION) - ipi_percentage) / PRECISION;
++
++ self_idle_ratio = PRECISION * 100 *
++ (td->ipi_period - (tx_assert_time / 1000)) /
++ td->ipi_period / PRECISION;
++
++ if (self_idle_ratio < ipi_idle_ratio)
++ channel_load = 0;
++ else
++ channel_load = self_idle_ratio - ipi_idle_ratio;
++
++ if (self_idle_ratio <= td->ipi_threshold) {
++ dev_info(dev->mt76.dev,
++ "band[%d]: self idle ratio = %d%%, idle ratio = %d%%\n",
++ phy->band_idx, self_idle_ratio, ipi_idle_ratio);
++ return;
++ }
++
++ channel_load = (100 * channel_load) / self_idle_ratio;
++ dev_info(dev->mt76.dev,
++ "band[%d]: chan load = %d%%, self idle ratio = %d%%, idle ratio = %d%%\n",
++ phy->band_idx, channel_load, self_idle_ratio, ipi_idle_ratio);
++ antenna_idx++;
++ }
++}
++
++static void
++mt7915_tm_ipi_work(struct work_struct *work)
++{
++ struct mt7915_phy *phy = container_of(work, struct mt7915_phy, ipi_work.work);
++ struct mt7915_dev *dev = phy->dev;
++ struct mt76_testmode_data *td = &phy->mt76->test;
++ u8 start_antenna_idx = 0, antenna_num = 1;
++
++ if (!is_mt7915(&dev->mt76)) {
++ struct mt7915_mcu_rdd_ipi_scan data;
++
++ if (phy->band_idx)
++ start_antenna_idx = 4;
++
++ /* Use all antenna */
++ if (td->ipi_antenna_idx == MT76_TM_IPI_ANTENNA_ALL)
++ antenna_num = 4;
++ else
++ start_antenna_idx += td->ipi_antenna_idx;
++
++ mt7915_mcu_ipi_hist_scan(phy, &data, 0, true);
++ mt7915_tm_dump_ipi(phy, &data, antenna_num, start_antenna_idx, true);
++ } else {
++ struct mt7915_mcu_rdd_ipi_ctrl data;
++
++ start_antenna_idx = 4;
++ mt7915_mcu_ipi_hist_ctrl(phy, &data, RDD_IPI_HIST_ALL_CNT, true);
++ mt7915_tm_dump_ipi(phy, &data, antenna_num, start_antenna_idx, false);
++ }
++}
++
++static inline void
++mt7915_tm_reset_ipi(struct mt7915_phy *phy)
++{
++#define IPI_RESET_BIT BIT(2)
++ struct mt7915_dev *dev = phy->dev;
++
++ if (is_mt7915(&dev->mt76))
++ mt7915_mcu_ipi_hist_ctrl(phy, NULL, RDD_SET_IPI_HIST_RESET, false);
++ else
++ mt76_set(dev, MT_WF_IPI_RESET, IPI_RESET_BIT);
++}
++
++static int
++mt7915_tm_set_ipi(struct mt7915_phy *phy)
++{
++ struct mt76_testmode_data *td = &phy->mt76->test;
++
++ mt7915_tm_reset_ipi(phy);
++
++ cancel_delayed_work(&phy->ipi_work);
++ ieee80211_queue_delayed_work(phy->mt76->hw, &phy->ipi_work,
++ msecs_to_jiffies(td->ipi_period));
++
++ return 0;
++}
++
+ static int
+ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+ u16 cw_max, u16 txop, u8 tx_cmd)
+@@ -1247,6 +1469,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+ phy->mt76->test.tx_mpdu_len = 0;
+ phy->test.bf_en = 0;
+ mt7915_tm_set_entry(phy);
++ } else {
++ INIT_DELAYED_WORK(&phy->ipi_work, mt7915_tm_ipi_work);
+ }
+ }
+
+@@ -2005,6 +2229,14 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+ mt7915_tm_set_cfg(phy);
+ if (changed & BIT(TM_CHANGED_TXBF_ACT))
+ mt7915_tm_set_txbf(phy);
++ if ((changed & BIT(TM_CHANGED_OFF_CHAN_CH)) &&
++ (changed & BIT(TM_CHANGED_OFF_CHAN_BW)))
++ mt7915_tm_set_offchan(phy);
++ if ((changed & BIT(TM_CHANGED_IPI_THRESHOLD)) &&
++ (changed & BIT(TM_CHANGED_IPI_PERIOD)))
++ mt7915_tm_set_ipi(phy);
++ if (changed & BIT(TM_CHANGED_IPI_RESET))
++ mt7915_tm_reset_ipi(phy);
+ }
+
+ static int
+diff --git a/testmode.c b/testmode.c
+index aa874a83..b19b872a 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -24,6 +24,13 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
+ [MT76_TM_ATTR_TX_TIME] = { .type = NLA_U32 },
+ [MT76_TM_ATTR_FREQ_OFFSET] = { .type = NLA_U32 },
+ [MT76_TM_ATTR_DRV_DATA] = { .type = NLA_NESTED },
++ [MT76_TM_ATTR_OFF_CH_SCAN_CH] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_OFF_CH_SCAN_PATH] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_IPI_THRESHOLD] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_IPI_PERIOD] = { .type = NLA_U32 },
++ [MT76_TM_ATTR_IPI_ANTENNA_INDEX] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_IPI_RESET] = { .type = NLA_U8 },
+ };
+ EXPORT_SYMBOL_GPL(mt76_tm_policy);
+
+@@ -402,6 +409,7 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
+ td->tx_count = 1;
+ td->tx_rate_mode = MT76_TM_TX_MODE_OFDM;
+ td->tx_rate_nss = 1;
++ td->ipi_antenna_idx = MT76_TM_IPI_ANTENNA_ALL;
+
+ memcpy(td->addr[0], phy->macaddr, ETH_ALEN);
+ memcpy(td->addr[1], phy->macaddr, ETH_ALEN);
+@@ -607,6 +615,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ if (tb[MT76_TM_ATTR_TX_RATE_IDX])
+ td->tx_rate_idx = nla_get_u8(tb[MT76_TM_ATTR_TX_RATE_IDX]);
+
++ if (tb[MT76_TM_ATTR_IPI_PERIOD])
++ td->ipi_period = nla_get_u32(tb[MT76_TM_ATTR_IPI_PERIOD]);
++
+ if (mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_MODE], &td->tx_rate_mode,
+ 0, MT76_TM_TX_MODE_MAX) ||
+ mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_NSS], &td->tx_rate_nss,
+@@ -623,7 +634,16 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ &td->tx_power_control, 0, 1) ||
+ mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &td->aid, 0, 16) ||
+ mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_ALLOC], &td->ru_alloc, 0, 0xff) ||
+- mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_IDX], &td->ru_idx, 0, 68))
++ mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_IDX], &td->ru_idx, 0, 68) ||
++ mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_CH], &td->offchan_ch, 36, 196) ||
++ mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH], &td->offchan_center_ch,
++ 36, 196) ||
++ mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_BW],
++ &td->offchan_bw, NL80211_CHAN_WIDTH_20_NOHT, NL80211_CHAN_WIDTH_160) ||
++ mt76_tm_get_u8(tb[MT76_TM_ATTR_IPI_THRESHOLD], &td->ipi_threshold, 0, 10) ||
++ mt76_tm_get_u8(tb[MT76_TM_ATTR_IPI_ANTENNA_INDEX], &td->ipi_antenna_idx,
++ MT76_TM_IPI_ANTENNA_0, MT76_TM_IPI_ANTENNA_ALL) ||
++ mt76_tm_get_u8(tb[MT76_TM_ATTR_IPI_RESET], &td->ipi_reset, 0, 1))
+ goto out;
+
+ if (tb[MT76_TM_ATTR_TX_LENGTH]) {
+@@ -857,6 +877,9 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_MODE, td->tx_rate_mode) ||
+ nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_SGI, td->tx_rate_sgi) ||
+ nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
++ nla_put_u8(msg, MT76_TM_ATTR_OFF_CH_SCAN_CH, td->offchan_ch) ||
++ nla_put_u8(msg, MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH, td->offchan_center_ch) ||
++ nla_put_u8(msg, MT76_TM_ATTR_OFF_CH_SCAN_BW, td->offchan_bw) ||
+ (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
+ nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
+ (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
+diff --git a/testmode.h b/testmode.h
+index 5d1fe793..27a00953 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -63,6 +63,20 @@
+ * (nested, u8 attrs)
+ *
+ * @MT76_TM_ATTR_CFG: config testmode rf feature (nested, see &mt76_testmode_cfg)
++ * @MT76_TM_ATTR_TXBF_ACT: txbf setting actions (u8)
++ * @MT76_TM_ATTR_TXBF_PARAM: txbf parameters (nested)
++ *
++ * @MT76_TM_ATTR_OFF_CH_SCAN_CH: config the channel of background chain (ZWDFS) (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH: config the center channel of background chain (ZWDFS) (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_BW: config the bandwidth of background chain (ZWDFS) (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_PATH: config the tx path of background chain (ZWDFS) (u8)
++ *
++ * @MT76_TM_ATTR_IPI_THRESHOLD: config the IPI index you want to read (u8)
++ * @MT76_TM_ATTR_IPI_PERIOD: config the time period for reading
++ * the histogram of specific IPI index (u8)
++ * @MT76_TM_ATTR_IPI_ANTENNA_INDEX: config the antenna index for reading
++ * the histogram of specific IPI index (u8)
++ * @MT76_TM_ATTR_IPI_RESET: Reset the IPI counter
+ *
+ */
+ enum mt76_testmode_attr {
+@@ -116,6 +130,16 @@ enum mt76_testmode_attr {
+ MT76_TM_ATTR_TXBF_ACT,
+ MT76_TM_ATTR_TXBF_PARAM,
+
++ MT76_TM_ATTR_OFF_CH_SCAN_CH,
++ MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH,
++ MT76_TM_ATTR_OFF_CH_SCAN_BW,
++ MT76_TM_ATTR_OFF_CH_SCAN_PATH,
++
++ MT76_TM_ATTR_IPI_THRESHOLD,
++ MT76_TM_ATTR_IPI_PERIOD,
++ MT76_TM_ATTR_IPI_ANTENNA_INDEX,
++ MT76_TM_ATTR_IPI_RESET,
++
+ /* keep last */
+ NUM_MT76_TM_ATTRS,
+ MT76_TM_ATTR_MAX = NUM_MT76_TM_ATTRS - 1,
+@@ -292,4 +316,25 @@ enum mt76_testmode_txbf_act {
+ MT76_TM_TXBF_ACT_MAX = NUM_MT76_TM_TXBF_ACT - 1,
+ };
+
++/**
++ * enum mt76_testmode_ipi_antenna - specify antenna index for ipi count
++ *
++ * @MT76_TM_IPI_ANTENNA_0: use antenna 0
++ * @MT76_TM_IPI_ANTENNA_1: use antenna 1
++ * @MT76_TM_IPI_ANTENNA_2: use antenna 2
++ * @MT76_TM_IPI_ANTENNA_3: use antenna 3
++ * @MT76_TM_IPI_ANTENNA_ALL: use all antenna
++ */
++enum mt76_testmode_ipi_antenna {
++ MT76_TM_IPI_ANTENNA_0,
++ MT76_TM_IPI_ANTENNA_1,
++ MT76_TM_IPI_ANTENNA_2,
++ MT76_TM_IPI_ANTENNA_3,
++ MT76_TM_IPI_ANTENNA_ALL,
++
++ /* keep last */
++ NUM_MT76_TM_IPI_ANTENNA,
++ MT76_TM_IPI_ANTENNA_MAX = NUM_MT76_TM_IPI_ANTENNA - 1,
++};
++
+ #endif
+diff --git a/tools/fields.c b/tools/fields.c
+index 47fc69f9..6f07eed0 100644
+--- a/tools/fields.c
++++ b/tools/fields.c
+@@ -46,6 +46,14 @@ static const char * const testmode_txbf_act[] = {
+ [MT76_TM_TXBF_ACT_E2P_UPDATE] = "e2p_update",
+ };
+
++static const char * const testmode_offchan_bw[] = {
++ [NL80211_CHAN_WIDTH_20_NOHT] = "NOHT",
++ [NL80211_CHAN_WIDTH_20] = "20",
++ [NL80211_CHAN_WIDTH_40] = "40",
++ [NL80211_CHAN_WIDTH_80] = "80",
++ [NL80211_CHAN_WIDTH_160] = "160",
++};
++
+ static void print_enum(const struct tm_field *field, struct nlattr *attr)
+ {
+ unsigned int i = nla_get_u8(attr);
+@@ -411,6 +419,13 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
+ FIELD(u8, RU_IDX, "ru_idx"),
+ FIELD_ENUM(TXBF_ACT, "txbf_act", testmode_txbf_act),
+ FIELD_ARRAY(u16_hex, TXBF_PARAM, "txbf_param"),
++ FIELD(u8, OFF_CH_SCAN_CH, "offchan_ch"),
++ FIELD(u8, OFF_CH_SCAN_CENTER_CH, "offchan_center_ch"),
++ FIELD_ENUM(OFF_CH_SCAN_BW, "offchan_bw", testmode_offchan_bw),
++ FIELD(u8, IPI_THRESHOLD, "ipi_threshold"),
++ FIELD(u32, IPI_PERIOD, "ipi_period"),
++ FIELD(u8, IPI_ANTENNA_INDEX, "ipi_antenna_idx"),
++ FIELD(u8, IPI_RESET, "ipi_reset"),
+ FIELD_MAC(MAC_ADDRS, "mac_addrs"),
+ FIELD_NESTED_RO(STATS, stats, "",
+ .print_extra = print_extra_stats),
+@@ -442,6 +457,13 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
+ [MT76_TM_ATTR_RU_IDX] = { .type = NLA_U8 },
+ [MT76_TM_ATTR_STATS] = { .type = NLA_NESTED },
+ [MT76_TM_ATTR_TXBF_ACT] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_OFF_CH_SCAN_CH] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_OFF_CH_SCAN_BW] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_IPI_THRESHOLD] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_IPI_PERIOD] = { .type = NLA_U32 },
++ [MT76_TM_ATTR_IPI_ANTENNA_INDEX] = { .type = NLA_U8 },
++ [MT76_TM_ATTR_IPI_RESET] = { .type = NLA_U8 },
+ };
+
+ const struct tm_field msg_field = {
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
new file mode 100644
index 0000000..9e4c950
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -0,0 +1,34 @@
+From 5d6beb19bab77695d83719719a179437f7674806 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Sun, 24 Apr 2022 10:07:00 +0800
+Subject: [PATCH 1116/1128] mt76: mt7915: init rssi in WTBL when add station
+
+---
+ mt7915/main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/mt7915/main.c b/mt7915/main.c
+index e84d6132..9180689e 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -666,6 +666,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ struct mt7915_phy *phy;
+ #endif
+ int ret, idx;
++ u32 addr;
+
+ idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
+ if (idx < 0)
+@@ -689,6 +690,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ if (ret)
+ return ret;
+
++ addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 30);
++ mt76_rmw_field(dev, addr, GENMASK(7, 0), 0xa0);
++
+ #ifdef CONFIG_MTK_VENDOR
+ mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
+ #endif
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
new file mode 100644
index 0000000..5331089
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -0,0 +1,28 @@
+From 540e6d1ba99002e4ac0cc0ae93022ee20592e5c4 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Thu, 4 Aug 2022 14:08:11 +0800
+Subject: [PATCH 1117/1128] mt76: mt7915: reduce TWT SP sent to FW for cert
+
+Set TWT SP duration to 88 percent to prevent HW sends PPDU over TWT SP.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7915/mcu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 51ec151b..8ebe38f0 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -3773,7 +3773,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+ .own_mac_idx = mvif->mt76.omac_idx,
+ .flowid = flow->id,
+ .peer_id = cpu_to_le16(flow->wcid),
+- .duration = flow->duration,
++ .duration = (flow->duration * 7) >> 3,
+ .bss_idx = mvif->mt76.idx,
+ .start_tsf = cpu_to_le64(flow->tsf),
+ .mantissa = flow->mantissa,
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
new file mode 100644
index 0000000..bcdd484
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
@@ -0,0 +1,25 @@
+From bb596598ed5abff5cdf4ab659d77419573436baf Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Fri, 6 May 2022 15:58:42 +0800
+Subject: [PATCH 1118/1128] mt76: connac: airtime fairness feature off in
+ mac80211
+
+---
+ mac80211.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/mac80211.c b/mac80211.c
+index f8ca7ba1..7e0f0e0e 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -429,7 +429,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
+ WIPHY_FLAG_AP_UAPSD;
+
+ wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
+- wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_AIRTIME_FAIRNESS);
+ wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_AQL);
+
+ wiphy->available_antennas_tx = phy->antenna_mask;
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
new file mode 100644
index 0000000..7bc97f8
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -0,0 +1,202 @@
+From 2118a1b7be90a8ab8894e0094fbe4e14e498c767 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Fri, 20 May 2022 19:19:25 +0800
+Subject: [PATCH 1119/1128] mt76: mt7915: add mt7986 and mt7916 pre-calibration
+
+Add pre-calibration for mt7986 and mt7916. It has different data size
+with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
+respectively. DPD cal needs 300k.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7915/eeprom.c | 15 +++++------
+ mt7915/eeprom.h | 1 +
+ mt7915/mcu.c | 72 ++++++++++++++++++++++++++++++++++++-------------
+ 3 files changed, 62 insertions(+), 26 deletions(-)
+
+diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
+index 0bce0ce5..0f5862e3 100644
+--- a/mt7915/eeprom.c
++++ b/mt7915/eeprom.c
+@@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
+ {
+ struct mt76_dev *mdev = &dev->mt76;
+ u8 *eeprom = mdev->eeprom.data;
+- u32 val = eeprom[MT_EE_DO_PRE_CAL];
+- u32 offs;
++ u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
++ u32 size, val = eeprom[offs];
+
+- if (!dev->flash_mode)
++ if (!dev->flash_mode || !val)
+ return 0;
+
+- if (val != (MT_EE_WIFI_CAL_DPD | MT_EE_WIFI_CAL_GROUP))
+- return 0;
++ size = mt7915_get_cal_group_size(dev) +
++ (is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2);
+
+- val = MT_EE_CAL_GROUP_SIZE + MT_EE_CAL_DPD_SIZE;
+- dev->cal = devm_kzalloc(mdev->dev, val, GFP_KERNEL);
++ dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
+ if (!dev->cal)
+ return -ENOMEM;
+
+ offs = is_mt7915(&dev->mt76) ? MT_EE_PRECAL : MT_EE_PRECAL_V2;
+
+- return mt76_get_of_eeprom(mdev, dev->cal, offs, val);
++ return mt76_get_of_eeprom(mdev, dev->cal, offs, size);
+ }
+
+ static int mt7915_check_eeprom(struct mt7915_dev *dev)
+diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
+index 88aaa16a..fdae347e 100644
+--- a/mt7915/eeprom.h
++++ b/mt7915/eeprom.h
+@@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
+ MT_EE_DDIE_FT_VERSION = 0x050,
+ MT_EE_DO_PRE_CAL = 0x062,
+ MT_EE_WIFI_CONF = 0x190,
++ MT_EE_DO_PRE_CAL_V2 = 0x19a,
+ MT_EE_RATE_DELTA_2G = 0x252,
+ MT_EE_RATE_DELTA_5G = 0x29d,
+ MT_EE_TX0_POWER_2G = 0x2fc,
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 8ebe38f0..97b1cf3b 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2884,7 +2884,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+ {
+ u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
+- u32 total = MT_EE_CAL_GROUP_SIZE;
++ u32 total = mt7915_get_cal_group_size(dev);
++ u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
+
+ if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
+ return 0;
+@@ -2922,9 +2923,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+ return -1;
+ }
+
+-static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
++static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
+ {
+- static const u16 freq_list[] = {
++ const u16 freq_list_v1[] = {
+ 5180, 5200, 5220, 5240,
+ 5260, 5280, 5300, 5320,
+ 5500, 5520, 5540, 5560,
+@@ -2932,34 +2933,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+ 5660, 5680, 5700, 5745,
+ 5765, 5785, 5805, 5825
+ };
+- int offset_2g = ARRAY_SIZE(freq_list);
++ const u16 freq_list_v2[] = {
++ /* 6G BW20*/
++ 5955, 5975, 5995, 6015,
++ 6035, 6055, 6075, 6095,
++ 6115, 6135, 6155, 6175,
++ 6195, 6215, 6235, 6255,
++ 6275, 6295, 6315, 6335,
++ 6355, 6375, 6395, 6415,
++ 6435, 6455, 6475, 6495,
++ 6515, 6535, 6555, 6575,
++ 6595, 6615, 6635, 6655,
++ 6675, 6695, 6715, 6735,
++ 6755, 6775, 6795, 6815,
++ 6835, 6855, 6875, 6895,
++ 6915, 6935, 6955, 6975,
++ 6995, 7015, 7035, 7055,
++ 7075, 7095, 7115,
++ /* 6G BW160 */
++ 6025, 6185, 6345, 6505,
++ 6665, 6825, 6985,
++ /* 5G BW20 */
++ 5180, 5200, 5220, 5240,
++ 5260, 5280, 5300, 5320,
++ 5500, 5520, 5540, 5560,
++ 5580, 5600, 5620, 5640,
++ 5660, 5680, 5700, 5720,
++ 5745, 5765, 5785, 5805,
++ 5825, 5845, 5865, 5885,
++ /* 5G BW160 */
++ 5250, 5570, 5815
++ };
++ const u16 *freq_list = freq_list_v1;
++ int n_freqs = ARRAY_SIZE(freq_list_v1);
+ int idx;
+
++ if (!is_mt7915(&dev->mt76)) {
++ freq_list = freq_list_v2;
++ n_freqs = ARRAY_SIZE(freq_list_v2);
++ }
++
+ if (freq < 4000) {
+ if (freq < 2432)
+- return offset_2g;
++ return n_freqs;
+ if (freq < 2457)
+- return offset_2g + 1;
++ return n_freqs + 1;
+
+- return offset_2g + 2;
++ return n_freqs + 2;
+ }
+
+- if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
++ if (bw == NL80211_CHAN_WIDTH_80P80)
+ return -1;
+
+ if (bw != NL80211_CHAN_WIDTH_20) {
+- idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
+- freq + 10);
++ idx = mt7915_find_freq_idx(freq_list, n_freqs, freq + 10);
+ if (idx >= 0)
+ return idx;
+
+- idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
+- freq - 10);
++ idx = mt7915_find_freq_idx(freq_list, n_freqs, freq - 10);
+ if (idx >= 0)
+ return idx;
+ }
+
+- return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
++ return mt7915_find_freq_idx(freq_list, n_freqs, freq);
+ }
+
+ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -2991,24 +3027,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+ if (!(eep[offs] & dpd_mask))
+ return 0;
+
+- idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
++ idx = mt7915_dpd_freq_idx(dev, center_freq, chandef->width);
+ if (idx < 0)
+ return -EINVAL;
+
+ /* Items: Tx DPD, Tx Flatness */
+- idx = idx * 2;
+- cal += MT_EE_CAL_GROUP_SIZE;
++ idx = idx * cal_num;
++ cal += mt7915_get_cal_group_size(dev) + (idx * MT_EE_CAL_UNIT);
+
+- while (total--) {
++ while (cal_num--) {
+ int ret;
+
+- cal += (idx * MT_EE_CAL_UNIT);
+ ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
+ MCU_EXT_CMD(DPD_PRE_CAL_INFO));
+ if (ret)
+ return ret;
+
+ idx++;
++ cal += MT_EE_CAL_UNIT;
+ }
+
+ return 0;
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
new file mode 100644
index 0000000..2012df4
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -0,0 +1,144 @@
+From b7a732694ec0bffaa3ff2805cdd6600ba3b598a9 Mon Sep 17 00:00:00 2001
+From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
+Date: Tue, 12 Jul 2022 10:04:35 -0700
+Subject: [PATCH 1120/1128] mt76: mt7915: add phy capability vendor command
+
+---
+ mt7915/mt7915.h | 1 +
+ mt7915/vendor.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h | 25 ++++++++++++++++++++++++
+ 3 files changed, 78 insertions(+)
+
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 0cbd02e2..69f1b6b4 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -11,6 +11,7 @@
+
+ #define MTK_DEBUG 1
+ #define MT7915_MAX_INTERFACES 19
++#define MT7915_MAX_BSS 16
+ #define MT7915_WTBL_SIZE 288
+ #define MT7916_WTBL_SIZE 544
+ #define MT7915_WTBL_RESERVED (mt7915_wtbl_size(dev) - 1)
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index c7551848..77d71e48 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
+ [MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF] = { .type = NLA_U8 },
+ };
+
++static const struct nla_policy
++phy_capa_ctrl_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_CTRL] = {
++ [MTK_VENDOR_ATTR_PHY_CAPA_CTRL_SET] = { .type = NLA_NESTED },
++ [MTK_VENDOR_ATTR_PHY_CAPA_CTRL_DUMP] = { .type = NLA_NESTED },
++};
++
++static const struct nla_policy
++phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
++ [MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_BSS] = { .type = NLA_U16 },
++ [MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_STA] = { .type = NLA_U16 },
++};
++
+ struct csi_null_tone {
+ u8 start;
+ u8 end;
+@@ -974,6 +986,35 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
+ return 0;
+ }
+
++static int
++mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
++ struct sk_buff *skb, const void *data, int data_len,
++ unsigned long *storage)
++{
++ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct mt7915_dev *dev = phy->dev;
++ void *a;
++ int len = 0;
++
++ if (*storage == 1)
++ return -ENOENT;
++ *storage = 1;
++
++ a = nla_nest_start(skb, MTK_VENDOR_ATTR_PHY_CAPA_CTRL_DUMP);
++
++ if (nla_put_u16(skb,
++ MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_BSS, MT7915_MAX_BSS) ||
++ nla_put_u16(skb,
++ MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_STA, MT7915_WTBL_STA))
++ return -ENOMEM;
++ len += 2;
++
++ nla_nest_end(skb, a);
++
++ return len;
++}
++
+ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ {
+ .info = {
+@@ -1031,6 +1072,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ .doit = mt7915_vendor_hemu_ctrl,
+ .policy = hemu_ctrl_policy,
+ .maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
++ },
++ {
++ .info = {
++ .vendor_id = MTK_NL80211_VENDOR_ID,
++ .subcmd = MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL,
++ },
++ .flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++ WIPHY_VENDOR_CMD_NEED_RUNNING,
++ .dumpit = mt7915_vendor_phy_capa_ctrl_dump,
++ .policy = phy_capa_ctrl_policy,
++ .maxattr = MTK_VENDOR_ATTR_PHY_CAPA_CTRL_MAX,
+ }
+ };
+
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index a8e4ebf9..719b851f 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
+ MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
+ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
++ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
+ };
+
+ enum mtk_capi_control_changed {
+@@ -149,4 +150,28 @@ enum mtk_vendor_attr_mnt_dump {
+ NUM_MTK_VENDOR_ATTRS_AMNT_DUMP - 1
+ };
+
++enum mtk_vendor_attr_phy_capa_ctrl {
++ MTK_VENDOR_ATTR_PHY_CAPA_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_PHY_CAPA_CTRL_SET,
++ MTK_VENDOR_ATTR_PHY_CAPA_CTRL_DUMP,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_PHY_CAPA_CTRL,
++ MTK_VENDOR_ATTR_PHY_CAPA_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_PHY_CAPA_CTRL - 1
++};
++
++enum mtk_vendor_attr_phy_capa_dump {
++ MTK_VENDOR_ATTR_PHY_CAPA_DUMP_UNSPEC,
++
++ MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_BSS,
++ MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_STA,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP,
++ MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP - 1
++};
++
+ #endif
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
new file mode 100644
index 0000000..940b835
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
@@ -0,0 +1,382 @@
+From c33574d98607b2ff23a683fb30a8de2ebbc9c8f2 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Fri, 24 Jun 2022 11:15:45 +0800
+Subject: [PATCH 1121/1128] mt76: mt7915: add vendor subcmd EDCCA ctrl
+ enable/threshold/compensation
+
+Change-Id: I06a3f94d5e444be894200e2b6588d76ed38d09d0
+---
+ mt76_connac_mcu.h | 1 +
+ mt7915/main.c | 3 ++
+ mt7915/mcu.c | 72 +++++++++++++++++++++++++
+ mt7915/mcu.h | 21 ++++++++
+ mt7915/mt7915.h | 3 +-
+ mt7915/vendor.c | 134 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h | 33 ++++++++++++
+ 7 files changed, 266 insertions(+), 1 deletion(-)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index c353341e..9339b711 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1189,6 +1189,7 @@ enum {
+ MCU_EXT_CMD_SMESH_CTRL = 0xae,
+ MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
+ MCU_EXT_CMD_CERT_CFG = 0xb7,
++ MCU_EXT_CMD_EDCCA = 0xba,
+ MCU_EXT_CMD_CSI_CTRL = 0xc2,
+ MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
+ };
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 9180689e..83b97d23 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -454,6 +454,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+ mutex_unlock(&dev->mt76.mutex);
+ }
+ #endif
++ ret = mt7915_mcu_set_edcca(phy, EDCCA_CTRL_SET_EN, NULL, 0);
++ if (ret)
++ return ret;
+ ieee80211_stop_queues(hw);
+ ret = mt7915_set_channel(phy);
+ if (ret)
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 97b1cf3b..cd6f3292 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -4552,3 +4552,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+
+ return 0;
+ }
++
++int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation)
++{
++ static const u8 ch_band[] = {
++ [NL80211_BAND_2GHZ] = 0,
++ [NL80211_BAND_5GHZ] = 1,
++ [NL80211_BAND_6GHZ] = 2,
++ };
++ struct mt7915_dev *dev = phy->dev;
++ struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
++ struct {
++ u8 band_idx;
++ u8 cmd_idx;
++ u8 setting[3];
++ bool record_in_fw;
++ u8 region;
++ s8 thres_compensation;
++ } __packed req = {
++ .band_idx = phy->band_idx,
++ .cmd_idx = mode,
++ .record_in_fw = false,
++ .thres_compensation = compensation,
++ };
++
++ if (ch_band[chandef->chan->band] == 2 && dev->mt76.region == NL80211_DFS_FCC)
++ req.region = dev->mt76.region;
++
++ if (mode == EDCCA_CTRL_SET_EN) {
++ req.setting[0] = (!value)? EDCCA_MODE_AUTO: value[0];
++ } else if (mode == EDCCA_CTRL_SET_THERS) {
++ req.setting[0] = value[0];
++ req.setting[1] = value[1];
++ req.setting[2] = value[2];
++ } else {
++ return -EINVAL;
++ }
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCCA), &req, sizeof(req), true);
++}
++
++
++int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value)
++{
++ struct mt7915_dev *dev = phy->dev;
++ struct {
++ u8 band_idx;
++ u8 cmd_idx;
++ u8 setting[3];
++ bool record_in_fw;
++ u8 region;
++ s8 thres_compensation;
++ } __packed req = {
++ .band_idx = phy->band_idx,
++ .cmd_idx = mode,
++ .record_in_fw = false,
++ };
++ struct sk_buff *skb;
++ int ret;
++ struct mt7915_mcu_edcca_info *res;
++
++ ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(EDCCA), &req, sizeof(req),
++ true, &skb);
++ if (ret)
++ return ret;
++
++ res = (struct mt7915_mcu_edcca_info *)skb->data;
++ *value++ = res->info[0];
++ *value++ = res->info[1];
++ *value = res->info[2];
++
++ return 0;
++}
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 300b7834..de265d15 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -866,6 +866,27 @@ enum {
+ MURU_DL_INIT,
+ MURU_UL_INIT,
+ };
++
++enum {
++ EDCCA_CTRL_SET_EN = 0,
++ EDCCA_CTRL_SET_THERS,
++ EDCCA_CTRL_GET_EN,
++ EDCCA_CTRL_GET_THERS,
++ EDCCA_CTRL_NUM,
++};
++
++enum {
++ EDCCA_MODE_FORCE_DISABLE,
++ EDCCA_MODE_AUTO,
++};
++
++struct mt7915_mcu_edcca_info {
++ u8 cmd_idx;
++ u8 band_idx;
++ u8 info[3];
++ u8 fginit;
++ u8 rsv[2];
++};
+ #endif
+
+ #endif
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 69f1b6b4..aaab5f7a 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -754,7 +754,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+ struct ieee80211_sta *sta);
+ #endif
+-
++int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
++int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
+ int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
+ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
+
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index 77d71e48..cd5c3b83 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -62,6 +62,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
+ [MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_STA] = { .type = NLA_U16 },
+ };
+
++static const struct nla_policy
++edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_S8 },
++};
++
++static const struct nla_policy
++edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
++ [MTK_VENDOR_ATTR_EDCCA_DUMP_MODE] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL] = { .type = NLA_U8 },
++};
++
+ struct csi_null_tone {
+ u8 start;
+ u8 end;
+@@ -1015,6 +1033,110 @@ mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+ return len;
+ }
+
++static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
++ struct wireless_dev *wdev,
++ const void *data,
++ int data_len)
++{
++ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL];
++ int err;
++ u8 edcca_mode;
++ s8 edcca_compensation;
++ u8 edcca_value[EDCCA_THRES_NUM] = {0};
++
++ err = nla_parse(tb, MTK_VENDOR_ATTR_EDCCA_CTRL_MAX, data, data_len,
++ edcca_ctrl_policy, NULL);
++ if (err)
++ return err;
++
++ if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE])
++ return -EINVAL;
++
++ edcca_mode = nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE]);
++ if (edcca_mode == EDCCA_CTRL_SET_EN) {
++ if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] ||
++ !tb[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE]) {
++ return -EINVAL;
++ }
++ edcca_value[0] =
++ nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL]);
++ edcca_compensation =
++ nla_get_s8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE]);
++
++ err = mt7915_mcu_set_edcca(phy, edcca_mode, edcca_value,
++ edcca_compensation);
++ if (err)
++ return err;
++ } else if (edcca_mode == EDCCA_CTRL_SET_THERS) {
++ if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] ||
++ !tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] ||
++ !tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL]) {
++ return -EINVAL;
++ }
++ edcca_value[0] =
++ nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL]);
++ edcca_value[1] =
++ nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL]);
++ edcca_value[2] =
++ nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL]);
++ err = mt7915_mcu_set_edcca(phy, edcca_mode, edcca_value,
++ edcca_compensation);
++ if (err)
++ return err;
++ } else {
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
++static int
++mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
++ struct sk_buff *skb, const void *data, int data_len,
++ unsigned long *storage)
++{
++ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct mt7915_dev *dev = phy->dev;
++ struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL];
++ void *a;
++ int len = EDCCA_THRES_NUM;
++ int err;
++ u8 edcca_mode;
++ s8 value[EDCCA_THRES_NUM];
++
++ if (*storage == 1)
++ return -ENOENT;
++ *storage = 1;
++
++ err = nla_parse(tb, MTK_VENDOR_ATTR_EDCCA_CTRL_MAX, data, data_len,
++ edcca_ctrl_policy, NULL);
++ if (err)
++ return err;
++
++ if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE])
++ return -EINVAL;
++
++ edcca_mode = nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE]);
++ if (edcca_mode == EDCCA_CTRL_GET_EN || edcca_mode == EDCCA_CTRL_GET_THERS) {
++ err = mt7915_mcu_get_edcca(phy, edcca_mode, value);
++ } else {
++ return -EINVAL;
++ }
++
++ if (err)
++ return err;
++
++ if (nla_put_u8(skb, MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL, value[0]) ||
++ nla_put_u8(skb, MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL, value[1]) ||
++ nla_put_u8(skb, MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL, value[2]))
++ return -ENOMEM;
++
++ return len;
++}
++
+ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ {
+ .info = {
+@@ -1083,6 +1205,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ .dumpit = mt7915_vendor_phy_capa_ctrl_dump,
+ .policy = phy_capa_ctrl_policy,
+ .maxattr = MTK_VENDOR_ATTR_PHY_CAPA_CTRL_MAX,
++ },
++ {
++ .info = {
++ .vendor_id = MTK_NL80211_VENDOR_ID,
++ .subcmd = MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL,
++ },
++ .flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++ WIPHY_VENDOR_CMD_NEED_RUNNING,
++ .doit = mt7915_vendor_edcca_ctrl,
++ .dumpit = mt7915_vendor_edcca_ctrl_dump,
++ .policy = edcca_ctrl_policy,
++ .maxattr = MTK_VENDOR_ATTR_EDCCA_CTRL_MAX,
+ }
+ };
+
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index 719b851f..72319717 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -2,6 +2,7 @@
+ #define __MT7915_VENDOR_H
+
+ #define MTK_NL80211_VENDOR_ID 0x0ce7
++#define EDCCA_THRES_NUM 3
+
+ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
+@@ -10,6 +11,38 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
+ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++};
++
++
++enum mtk_vendor_attr_edcca_ctrl {
++ MTK_VENDOR_ATTR_EDCCA_THRESHOLD_INVALID = 0,
++
++ MTK_VENDOR_ATTR_EDCCA_CTRL_MODE,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
++};
++
++enum mtk_vendor_attr_edcca_dump {
++ MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
++
++ MTK_VENDOR_ATTR_EDCCA_DUMP_MODE,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
+ };
+
+ enum mtk_capi_control_changed {
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch
new file mode 100644
index 0000000..1357d9a
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch
@@ -0,0 +1,324 @@
+From a811ab8ab270c406e6360910a3dc09255990b3aa Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 7 Jul 2022 11:09:59 +0800
+Subject: [PATCH 1122/1128] mt76: mt7915: implement bin file mode
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ eeprom.c | 18 +++++++++++++++
+ mt76.h | 1 +
+ mt7915/eeprom.c | 52 ++++++++++++++++++++------------------------
+ mt7915/eeprom.h | 44 +++++++++++++++++++++++++++++++++++++
+ mt7915/mt7915.h | 17 ++++++++++++---
+ mt7915/mtk_debugfs.c | 41 ++++++++++++++++++++++++++++++++++
+ 6 files changed, 141 insertions(+), 32 deletions(-)
+
+diff --git a/eeprom.c b/eeprom.c
+index e083964b..5b9faf7e 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -104,6 +104,24 @@ out_put_node:
+ }
+ EXPORT_SYMBOL_GPL(mt76_get_of_eeprom);
+
++bool mt76_check_bin_file_mode(struct mt76_dev *dev)
++{
++ struct device_node *np = dev->dev->of_node;
++ const __be32 *bin_file_mode;
++ bool ret = false;
++
++ if (!np)
++ return false;
++
++ bin_file_mode = of_get_property(np, "bin_file_mode", NULL);
++ if (bin_file_mode && be32_to_cpu(*bin_file_mode))
++ ret = true;
++
++ of_node_put(np);
++ return ret;
++}
++EXPORT_SYMBOL_GPL(mt76_check_bin_file_mode);
++
+ void
+ mt76_eeprom_override(struct mt76_phy *phy)
+ {
+diff --git a/mt76.h b/mt76.h
+index 8139b4ad..db2075c3 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -1027,6 +1027,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+ int mt76_eeprom_init(struct mt76_dev *dev, int len);
+ void mt76_eeprom_override(struct mt76_phy *phy);
+ int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
++bool mt76_check_bin_file_mode(struct mt76_dev *dev);
+
+ struct mt76_queue *
+ mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
+diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
+index 0f5862e3..4d2d9ca2 100644
+--- a/mt7915/eeprom.c
++++ b/mt7915/eeprom.c
+@@ -42,33 +42,6 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
+ }
+ }
+
+-static char *mt7915_eeprom_name(struct mt7915_dev *dev)
+-{
+- switch (mt76_chip(&dev->mt76)) {
+- case 0x7915:
+- return dev->dbdc_support ?
+- MT7915_EEPROM_DEFAULT_DBDC : MT7915_EEPROM_DEFAULT;
+- case 0x7986:
+- switch (mt7915_check_adie(dev, true)) {
+- case MT7976_ONE_ADIE_DBDC:
+- return MT7986_EEPROM_MT7976_DEFAULT_DBDC;
+- case MT7975_ONE_ADIE:
+- return MT7986_EEPROM_MT7975_DEFAULT;
+- case MT7976_ONE_ADIE:
+- return MT7986_EEPROM_MT7976_DEFAULT;
+- case MT7975_DUAL_ADIE:
+- return MT7986_EEPROM_MT7975_DUAL_DEFAULT;
+- case MT7976_DUAL_ADIE:
+- return MT7986_EEPROM_MT7976_DUAL_DEFAULT;
+- default:
+- break;
+- }
+- return NULL;
+- default:
+- return MT7916_EEPROM_DEFAULT;
+- }
+-}
+-
+ static int
+ mt7915_eeprom_load_default(struct mt7915_dev *dev)
+ {
+@@ -81,7 +54,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
+ return ret;
+
+ if (!fw || !fw->data) {
+- dev_err(dev->mt76.dev, "Invalid default bin\n");
++ if (dev->bin_file_mode)
++ dev_err(dev->mt76.dev, "Invalid bin (bin file mode)\n");
++ else
++ dev_err(dev->mt76.dev, "Invalid default bin\n");
+ ret = -EINVAL;
+ goto out;
+ }
+@@ -106,6 +82,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+
+ if (ret) {
+ dev->flash_mode = true;
++ dev->eeprom_mode = FLASH_MODE;
+ } else {
+ u8 free_block_num;
+ u32 block_num, i;
+@@ -121,6 +98,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+ for (i = 0; i < block_num; i++)
+ mt7915_mcu_get_eeprom(dev,
+ i * MT7915_EEPROM_BLOCK_SIZE);
++ dev->eeprom_mode = EFUSE_MODE;
+ }
+
+ return mt7915_check_eeprom(dev);
+@@ -224,12 +202,28 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+ {
+ int ret;
+
+- ret = mt7915_eeprom_load(dev);
++ dev->bin_file_mode = mt76_check_bin_file_mode(&dev->mt76);
++
++ if (dev->bin_file_mode) {
++ dev->mt76.eeprom.size = mt7915_eeprom_size(dev);
++ dev->mt76.eeprom.data = devm_kzalloc(dev->mt76.dev, dev->mt76.eeprom.size,
++ GFP_KERNEL);
++ if (!dev->mt76.eeprom.data)
++ return -ENOMEM;
++ ret = mt7915_eeprom_load_default(dev);
++ dev->eeprom_mode = BIN_FILE_MODE;
++ } else {
++ ret = mt7915_eeprom_load(dev);
++ }
++
+ if (ret < 0) {
+ if (ret != -EINVAL)
+ return ret;
+
+ dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
++ dev->bin_file_mode = false;
++ dev->eeprom_mode = DEFAULT_BIN_MODE;
++
+ ret = mt7915_eeprom_load_default(dev);
+ if (ret)
+ return ret;
+diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
+index fdae347e..f228926b 100644
+--- a/mt7915/eeprom.h
++++ b/mt7915/eeprom.h
+@@ -108,6 +108,13 @@ enum mt7915_sku_rate_group {
+ MAX_SKU_RATE_GROUP_NUM,
+ };
+
++enum mt7915_eeprom_mode {
++ DEFAULT_BIN_MODE,
++ EFUSE_MODE,
++ FLASH_MODE,
++ BIN_FILE_MODE,
++};
++
+ static inline int
+ mt7915_get_channel_group_5g(int channel, bool is_7976)
+ {
+@@ -184,6 +191,43 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
+ }
+ }
+
++static inline char *mt7915_eeprom_name(struct mt7915_dev *dev)
++{
++ switch (mt76_chip(&dev->mt76)) {
++ case 0x7915:
++ if (dev->bin_file_mode)
++ return dev->dbdc_support ?
++ MT7915_BIN_FILE_DBDC : MT7915_BIN_FILE;
++ else
++ return dev->dbdc_support ?
++ MT7915_EEPROM_DEFAULT_DBDC : MT7915_EEPROM_DEFAULT;
++ case 0x7986:
++ switch (mt7915_check_adie(dev, true)) {
++ case MT7976_ONE_ADIE_DBDC:
++ return dev->bin_file_mode ?
++ MT7986_BIN_FILE_MT7976_DBDC : MT7986_EEPROM_MT7976_DEFAULT_DBDC;
++ case MT7975_ONE_ADIE:
++ return dev->bin_file_mode ?
++ MT7986_BIN_FILE_MT7975 : MT7986_EEPROM_MT7975_DEFAULT;
++ case MT7976_ONE_ADIE:
++ return dev->bin_file_mode ?
++ MT7986_BIN_FILE_MT7976 : MT7986_EEPROM_MT7976_DEFAULT;
++ case MT7975_DUAL_ADIE:
++ return dev->bin_file_mode ?
++ MT7986_BIN_FILE_MT7975_DUAL : MT7986_EEPROM_MT7975_DUAL_DEFAULT;
++ case MT7976_DUAL_ADIE:
++ return dev->bin_file_mode ?
++ MT7986_BIN_FILE_MT7976_DUAL : MT7986_EEPROM_MT7976_DUAL_DEFAULT;
++ default:
++ break;
++ }
++ return NULL;
++ default:
++ return dev->bin_file_mode ?
++ MT7916_BIN_FILE : MT7916_EEPROM_DEFAULT;
++ }
++}
++
+ extern const u8 mt7915_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
+
+ #endif
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index aaab5f7a..5a206f7a 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -42,15 +42,24 @@
+ #define MT7986_ROM_PATCH "mediatek/mt7986_rom_patch.bin"
+ #define MT7986_ROM_PATCH_MT7975 "mediatek/mt7986_rom_patch_mt7975.bin"
+
+-#define MT7915_EEPROM_DEFAULT "mediatek/mt7915_eeprom.bin"
+-#define MT7915_EEPROM_DEFAULT_DBDC "mediatek/mt7915_eeprom_dbdc.bin"
+-#define MT7916_EEPROM_DEFAULT "mediatek/mt7916_eeprom.bin"
++#define MT7915_EEPROM_DEFAULT "mediatek/mt7915_eeprom.bin"
++#define MT7915_EEPROM_DEFAULT_DBDC "mediatek/mt7915_eeprom_dbdc.bin"
++#define MT7916_EEPROM_DEFAULT "mediatek/mt7916_eeprom.bin"
+ #define MT7986_EEPROM_MT7975_DEFAULT "mediatek/mt7986_eeprom_mt7975.bin"
+ #define MT7986_EEPROM_MT7975_DUAL_DEFAULT "mediatek/mt7986_eeprom_mt7975_dual.bin"
+ #define MT7986_EEPROM_MT7976_DEFAULT "mediatek/mt7986_eeprom_mt7976.bin"
+ #define MT7986_EEPROM_MT7976_DEFAULT_DBDC "mediatek/mt7986_eeprom_mt7976_dbdc.bin"
+ #define MT7986_EEPROM_MT7976_DUAL_DEFAULT "mediatek/mt7986_eeprom_mt7976_dual.bin"
+
++#define MT7915_BIN_FILE "mediatek/mt7915_binfile.bin"
++#define MT7915_BIN_FILE_DBDC "mediatek/mt7915_binfile_dbdc.bin"
++#define MT7916_BIN_FILE "mediatek/mt7916_binfile.bin"
++#define MT7986_BIN_FILE_MT7975 "mediatek/mt7986_binfile_mt7975.bin"
++#define MT7986_BIN_FILE_MT7975_DUAL "mediatek/mt7986_binfile_mt7975_dual.bin"
++#define MT7986_BIN_FILE_MT7976 "mediatek/mt7986_binfile_mt7976.bin"
++#define MT7986_BIN_FILE_MT7976_DBDC "mediatek/mt7986_binfile_mt7976_dbdc.bin"
++#define MT7986_BIN_FILE_MT7976_DUAL "mediatek/mt7986_binfile_mt7976_dual.bin"
++
+ #define MT7915_EEPROM_SIZE 3584
+ #define MT7916_EEPROM_SIZE 4096
+
+@@ -397,6 +406,8 @@ struct mt7915_dev {
+
+ bool dbdc_support;
+ bool flash_mode;
++ bool bin_file_mode;
++ u8 eeprom_mode;
+ bool muru_debug;
+ bool ibf;
+
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index d96f222a..9a9e0cb6 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -3,6 +3,7 @@
+ #include "mt7915_debug.h"
+ #include "mac.h"
+ #include "mcu.h"
++#include "eeprom.h"
+
+ #ifdef MTK_DEBUG
+ #define LWTBL_IDX2BASE_ID GENMASK(14, 8)
+@@ -2893,6 +2894,44 @@ mt7915_wa_debug(void *data, u64 val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_debug, NULL, mt7915_wa_debug,
+ "0x%llx\n");
+
++static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
++{
++ struct mt7915_dev *dev = dev_get_drvdata(s->private);
++ struct mt76_dev *mdev = &dev->mt76;
++#ifdef CONFIG_NL80211_TESTMODE
++ char *mtd_name = mdev->test_mtd.name;
++ u32 mtd_offset = mdev->test_mtd.offset;
++#else
++ char *mtd_name;
++ u32 mtd_offset;
++#endif
++
++ seq_printf(s, "Current eeprom mode:\n");
++
++ switch (dev->eeprom_mode) {
++ case DEFAULT_BIN_MODE:
++ seq_printf(s, " default bin mode\n filename = %s\n", mt7915_eeprom_name(dev));
++ break;
++ case EFUSE_MODE:
++ seq_printf(s, " efuse mode\n");
++ break;
++ case FLASH_MODE:
++ if (mtd_name)
++ seq_printf(s, " flash mode\n mtd name = %s\n flash offset = 0x%x\n",
++ mtd_name, mtd_offset);
++ else
++ seq_printf(s, " flash mode\n");
++ break;
++ case BIN_FILE_MODE:
++ seq_printf(s, " bin file mode\n filename = %s\n", mt7915_eeprom_name(dev));
++ break;
++ default:
++ break;
++ }
++
++ return 0;
++}
++
+ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ {
+ struct mt7915_dev *dev = phy->dev;
+@@ -2973,6 +3012,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
+ mt7915_dump_version);
+
++ debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
++ mt7915_show_eeprom_mode);
+ return 0;
+ }
+ #endif
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch
new file mode 100644
index 0000000..d34181e
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch
@@ -0,0 +1,26 @@
+From 010250dee3f031e1de7edc5c867b2057454a61a0 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Tue, 12 Jul 2022 13:56:07 +0800
+Subject: [PATCH 1123/1128] mt76: mt7915: initialize wcid
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ mt7915/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 3b144ad0..dc4c6eb3 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1031,7 +1031,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+ info = le32_to_cpu(*cur_info);
+ if (info & MT_TX_FREE_PAIR) {
+ struct mt7915_sta *msta;
+- struct mt76_wcid *wcid;
++ struct mt76_wcid *wcid = NULL;
+ u16 idx;
+
+ idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
new file mode 100644
index 0000000..74a5e86
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
@@ -0,0 +1,77 @@
+From 88e63910976d94c67751edc6a430b27d1049bb6a Mon Sep 17 00:00:00 2001
+From: TomLiu <tomml.liu@mediatek.com>
+Date: Thu, 11 Aug 2022 18:09:45 -0700
+Subject: [PATCH 1124/1128] mt76: mt7915: Add hemu dump support
+
+Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
+---
+ mt7915/vendor.c | 26 ++++++++++++++++++++++++++
+ mt7915/vendor.h | 1 +
+ 2 files changed, 27 insertions(+)
+
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index cd5c3b83..5e34b852 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
+ static const struct nla_policy
+ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
+ [MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_HEMU_CTRL_DUMP] = {.type = NLA_U8 },
+ };
+
+ static const struct nla_policy
+@@ -1004,6 +1005,30 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
+ return 0;
+ }
+
++
++static int
++mt7915_vendor_hemu_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
++ struct sk_buff *skb, const void *data, int data_len,
++ unsigned long *storage)
++{
++ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct mt7915_dev *dev = phy->dev;
++ void *a;
++ int len = 0;
++
++ if (*storage == 1)
++ return -ENOENT;
++ *storage = 1;
++
++ if (nla_put_u8(skb, MTK_VENDOR_ATTR_HEMU_CTRL_DUMP, dev->dbg.muru_onoff))
++ return -ENOMEM;
++ len += 1;
++
++ return len;
++}
++
++
+ static int
+ mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+ struct sk_buff *skb, const void *data, int data_len,
+@@ -1192,6 +1217,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ .flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
+ WIPHY_VENDOR_CMD_NEED_RUNNING,
+ .doit = mt7915_vendor_hemu_ctrl,
++ .dumpit = mt7915_vendor_hemu_ctrl_dump,
+ .policy = hemu_ctrl_policy,
+ .maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
+ },
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index 72319717..c19ffe72 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -72,6 +72,7 @@ enum mtk_vendor_attr_hemu_ctrl {
+ MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
+
+ MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
++ MTK_VENDOR_ATTR_HEMU_CTRL_DUMP,
+
+ /* keep last */
+ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
new file mode 100644
index 0000000..88f7b33
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -0,0 +1,272 @@
+From f7ab85c232e5f4048e3f2a2bdc1141915d503ae4 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 28 Oct 2022 10:15:56 +0800
+Subject: [PATCH 1125/1128] mt76: mt7915: add vendor subcmd three wire (PTA)
+ ctrl
+
+Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt76_connac_mcu.h | 2 +-
+ mt7915/mcu.c | 50 ++++++++++++++++++++++-------------------------
+ mt7915/mcu.h | 29 +++++++++++++++++++++++++++
+ mt7915/mt7915.h | 1 +
+ mt7915/vendor.c | 44 ++++++++++++++++++++++++++++++++++++++++-
+ mt7915/vendor.h | 14 +++++++++++++
+ 6 files changed, 111 insertions(+), 29 deletions(-)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 9339b711..131257c7 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1188,7 +1188,7 @@ enum {
+ /* for vendor csi and air monitor */
+ MCU_EXT_CMD_SMESH_CTRL = 0xae,
+ MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
+- MCU_EXT_CMD_CERT_CFG = 0xb7,
++ MCU_EXT_CMD_SET_CFG = 0xb7,
+ MCU_EXT_CMD_EDCCA = 0xba,
+ MCU_EXT_CMD_CSI_CTRL = 0xc2,
+ MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index cd6f3292..4e7bc982 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -4234,37 +4234,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+ &req, sizeof(req), false);
+ }
+
+-void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type)
++int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type)
+ {
+-#define CFGINFO_CERT_CFG 4
+ struct mt7915_dev *dev = phy->dev;
+- struct {
+- struct basic_info{
+- u8 dbdc_idx;
+- u8 rsv[3];
+- __le32 tlv_num;
+- u8 tlv_buf[0];
+- } hdr;
+- struct cert_cfg{
+- __le16 tag;
+- __le16 length;
+- u8 cert_program;
+- u8 rsv[3];
+- } tlv;
+- } req = {
+- .hdr = {
+- .dbdc_idx = phy != &dev->phy,
+- .tlv_num = cpu_to_le32(1),
+- },
+- .tlv = {
+- .tag = cpu_to_le16(CFGINFO_CERT_CFG),
+- .length = cpu_to_le16(sizeof(struct cert_cfg)),
+- .cert_program = type, /* 1: CAPI Enable */
+- }
++ struct cfg_basic_info req = {
++ .dbdc_idx = phy != &dev->phy,
++ .tlv_num = cpu_to_le32(1),
+ };
++ int tlv_len;
++
++ switch (cfg_info) {
++ case CFGINFO_CERT_CFG:
++ tlv_len = sizeof(struct cert_cfg);
++ req.cert.tag = cpu_to_le16(cfg_info);
++ req.cert.length = cpu_to_le16(tlv_len);
++ req.cert.cert_program = type;
++ break;
++ case CFGINFO_3WIRE_EN_CFG:
++ tlv_len = sizeof(struct three_wire_cfg);
++ req.three_wire.tag = cpu_to_le16(cfg_info);
++ req.three_wire.length = cpu_to_le16(tlv_len);
++ req.three_wire.three_wire_en = type;
++ break;
++ default:
++ return -EOPNOTSUPP;
++ }
+
+- mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CERT_CFG),
+- &req, sizeof(req), false);
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_CFG), &req, sizeof(req), false);
+ }
+
+ void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index de265d15..9780f128 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -655,6 +655,35 @@ struct mt7915_mcu_rdd_ipi_scan {
+ u8 tx_assert_time; /* unit: us */
+ } __packed;
+
++struct cert_cfg {
++ __le16 tag;
++ __le16 length;
++ u8 cert_program;
++ u8 rsv[3];
++} __packed;
++
++struct three_wire_cfg {
++ __le16 tag;
++ __le16 length;
++ u8 three_wire_en;
++ u8 rsv[3];
++} __packed;
++
++struct cfg_basic_info {
++ u8 dbdc_idx;
++ u8 rsv[3];
++ __le32 tlv_num;
++ union {
++ struct cert_cfg cert;
++ struct three_wire_cfg three_wire;
++ };
++} __packed;
++
++enum {
++ CFGINFO_CERT_CFG = 4,
++ CFGINFO_3WIRE_EN_CFG = 10,
++};
++
+ /* MURU */
+ #define OFDMA_DL BIT(0)
+ #define OFDMA_UL BIT(1)
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 5a206f7a..626b2634 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -757,6 +757,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
+ int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
+ void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
++int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type);
+ void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val);
+ void mt7915_vendor_register(struct mt7915_phy *phy);
+ int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index 5e34b852..6b86b77a 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
+ [MTK_VENDOR_ATTR_HEMU_CTRL_DUMP] = {.type = NLA_U8 },
+ };
+
++static const struct nla_policy
++three_wire_ctrl_policy[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL] = {
++ [MTK_VENDOR_ATTR_3WIRE_CTRL_MODE] = {.type = NLA_U8 },
++};
++
+ static const struct nla_policy
+ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
+ [MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI] = {.type = NLA_U8 },
+@@ -971,7 +976,7 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
+ mt7915_set_wireless_vif, &val32);
+ } else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]) {
+ val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]);
+- mt7915_mcu_set_cert(phy, val8); /* Cert Enable for OMI */
++ mt7915_mcu_set_cfg(phy, CFGINFO_CERT_CFG, val8); /* Cert Enable for OMI */
+ mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
+ }
+
+@@ -1117,6 +1122,7 @@ static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
+ return 0;
+ }
+
++
+ static int
+ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+ struct sk_buff *skb, const void *data, int data_len,
+@@ -1162,6 +1168,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+ return len;
+ }
+
++static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
++ struct wireless_dev *wdev,
++ const void *data,
++ int data_len)
++{
++ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL];
++ int err;
++ u8 three_wire_mode;
++
++ err = nla_parse(tb, MTK_VENDOR_ATTR_3WIRE_CTRL_MAX, data, data_len,
++ three_wire_ctrl_policy, NULL);
++ if (err)
++ return err;
++
++ if (!tb[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE])
++ return -EINVAL;
++
++ three_wire_mode = nla_get_u8(tb[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE]);
++
++ return mt7915_mcu_set_cfg(phy, CFGINFO_3WIRE_EN_CFG, three_wire_mode);
++}
++
++
+ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ {
+ .info = {
+@@ -1243,6 +1274,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ .dumpit = mt7915_vendor_edcca_ctrl_dump,
+ .policy = edcca_ctrl_policy,
+ .maxattr = MTK_VENDOR_ATTR_EDCCA_CTRL_MAX,
++ },
++ {
++ .info = {
++ .vendor_id = MTK_NL80211_VENDOR_ID,
++ .subcmd = MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL,
++ },
++ .flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++ WIPHY_VENDOR_CMD_NEED_RUNNING,
++ .doit = mt7915_vendor_3wire_ctrl,
++ .policy = three_wire_ctrl_policy,
++ .maxattr = MTK_VENDOR_ATTR_3WIRE_CTRL_MAX,
+ }
+ };
+
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index c19ffe72..d96e5c23 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -12,6 +12,7 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
+ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++ MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
+ };
+
+
+@@ -31,6 +32,7 @@ enum mtk_vendor_attr_edcca_ctrl {
+ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
+ };
+
++
+ enum mtk_vendor_attr_edcca_dump {
+ MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
+
+@@ -45,6 +47,18 @@ enum mtk_vendor_attr_edcca_dump {
+ NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
+ };
+
++enum mtk_vendor_attr_3wire_ctrl {
++ MTK_VENDOR_ATTR_3WIRE_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_3WIRE_CTRL_MODE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL,
++ MTK_VENDOR_ATTR_3WIRE_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL - 1
++};
++
++
+ enum mtk_capi_control_changed {
+ CAPI_RFEATURE_CHANGED = BIT(16),
+ CAPI_WIRELESS_CHANGED = BIT(17),
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
new file mode 100644
index 0000000..47606a0
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
@@ -0,0 +1,151 @@
+From c327c081324034c44660ded9a50848da27c81879 Mon Sep 17 00:00:00 2001
+From: mtk27835 <shurong.wen@mediatek.com>
+Date: Wed, 7 Sep 2022 14:01:29 -0700
+Subject: [PATCH 1126/1128] mt76: mt7915: add ibf control vendor cmd
+
+Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
+---
+ mt7915/vendor.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h | 25 ++++++++++++++++-
+ 2 files changed, 95 insertions(+), 1 deletion(-)
+
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index 6b86b77a..e4915623 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -86,6 +86,17 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
+ [MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL] = { .type = NLA_U8 },
+ };
+
++static const struct nla_policy
++ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
++ [MTK_VENDOR_ATTR_IBF_CTRL_ENABLE] = { .type = NLA_U8 },
++};
++
++static struct nla_policy
++ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
++ [MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
++};
++
++
+ struct csi_null_tone {
+ u8 start;
+ u8 end;
+@@ -1192,6 +1203,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
+ return mt7915_mcu_set_cfg(phy, CFGINFO_3WIRE_EN_CFG, three_wire_mode);
+ }
+
++static int mt7915_vendor_ibf_ctrl(struct wiphy *wiphy,
++ struct wireless_dev *wdev,
++ const void *data,
++ int data_len)
++{
++ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct mt7915_dev *dev = phy->dev;
++ struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_IBF_CTRL];
++ int err;
++ u8 val;
++
++ err = nla_parse(tb, MTK_VENDOR_ATTR_IBF_CTRL_MAX, data, data_len,
++ ibf_ctrl_policy, NULL);
++ if (err)
++ return err;
++
++ if (tb[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE]) {
++ val = nla_get_u8(tb[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE]);
++
++ dev->ibf = !!val;
++
++ err = mt7915_mcu_set_txbf(dev, MT_BF_TYPE_UPDATE);
++ if (err)
++ return err;
++ }
++ return 0;
++}
++
++static int
++mt7915_vendor_ibf_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
++ struct sk_buff *skb, const void *data, int data_len,
++ unsigned long *storage)
++{
++ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++ struct mt7915_phy *phy = mt7915_hw_phy(hw);
++ struct mt7915_dev *dev = phy->dev;
++
++ if (*storage == 1)
++ return -ENOENT;
++ *storage = 1;
++
++ if (nla_put_u8(skb, MTK_VENDOR_ATTR_IBF_DUMP_ENABLE, dev->ibf))
++ return -ENOMEM;
++
++ return 1;
++}
++
+
+ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ {
+@@ -1285,6 +1344,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ .doit = mt7915_vendor_3wire_ctrl,
+ .policy = three_wire_ctrl_policy,
+ .maxattr = MTK_VENDOR_ATTR_3WIRE_CTRL_MAX,
++ },
++ {
++ .info = {
++ .vendor_id = MTK_NL80211_VENDOR_ID,
++ .subcmd = MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL,
++ },
++ .flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++ WIPHY_VENDOR_CMD_NEED_RUNNING,
++ .doit = mt7915_vendor_ibf_ctrl,
++ .dumpit = mt7915_vendor_ibf_ctrl_dump,
++ .policy = ibf_ctrl_policy,
++ .maxattr = MTK_VENDOR_ATTR_IBF_CTRL_MAX,
+ }
+ };
+
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index d96e5c23..949c8853 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -12,7 +12,8 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
+ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
+- MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
++ MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
++ MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
+ };
+
+
+@@ -222,4 +223,26 @@ enum mtk_vendor_attr_phy_capa_dump {
+ NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP - 1
+ };
+
++enum mtk_vendor_attr_ibf_ctrl {
++ MTK_VENDOR_ATTR_IBF_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_IBF_CTRL_ENABLE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_IBF_CTRL,
++ MTK_VENDOR_ATTR_IBF_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_IBF_CTRL - 1
++};
++
++enum mtk_vendor_attr_ibf_dump {
++ MTK_VENDOR_ATTR_IBF_DUMP_UNSPEC,
++
++ MTK_VENDOR_ATTR_IBF_DUMP_ENABLE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_IBF_DUMP,
++ MTK_VENDOR_ATTR_IBF_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_IBF_DUMP - 1
++};
++
+ #endif
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
new file mode 100644
index 0000000..f2b554d
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
@@ -0,0 +1,120 @@
+From ccbf47f2ebfed7523d92f17bd74352bd88779869 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 13 Oct 2022 13:22:05 +0800
+Subject: [PATCH 1127/1128] mt76: mt7915: add E3 re-bonding for low yield rate
+ issue
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7915/eeprom.c | 27 ++++++++++++++++++++++++++-
+ mt7915/mcu.c | 13 ++++++++++---
+ mt7915/mt7915.h | 3 ++-
+ 3 files changed, 38 insertions(+), 5 deletions(-)
+
+diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
+index 4d2d9ca2..b3d2bbc5 100644
+--- a/mt7915/eeprom.c
++++ b/mt7915/eeprom.c
+@@ -97,7 +97,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+ MT7915_EEPROM_BLOCK_SIZE);
+ for (i = 0; i < block_num; i++)
+ mt7915_mcu_get_eeprom(dev,
+- i * MT7915_EEPROM_BLOCK_SIZE);
++ i * MT7915_EEPROM_BLOCK_SIZE, NULL);
+ dev->eeprom_mode = EFUSE_MODE;
+ }
+
+@@ -198,6 +198,29 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
+ dev->chainshift = hweight8(dev->mphy.chainmask);
+ }
+
++void mt7915_eeprom_rebonding(struct mt7915_dev *dev)
++{
++#define MT7976_ADIE_MASK BIT(1)
++#define MT7986_ADIE1_EFFUSE_OFFSET 0x1000
++#define MT7986_ADIE1_MT7976C_OFFSET 0x270
++#define MT7986_ADIE1_E3_OFFSET 0x271
++ u32 adie_offset, sku = mt7915_check_adie(dev, true);
++ u8 read_buf, *eeprom = dev->mt76.eeprom.data;
++
++ if (!(sku & MT7976_ADIE_MASK))
++ return;
++
++ adie_offset = (sku == MT7976_DUAL_ADIE) ? MT7986_ADIE1_EFFUSE_OFFSET : 0;
++
++ /* 7976 A-Die, To identify MT7976C */
++ mt7915_mcu_get_eeprom(dev, MT7986_ADIE1_MT7976C_OFFSET + adie_offset, &read_buf);
++ eeprom[MT7986_ADIE1_MT7976C_OFFSET] = read_buf;
++
++ /* E3 re-binding */
++ mt7915_mcu_get_eeprom(dev, MT7986_ADIE1_E3_OFFSET + adie_offset, &read_buf);
++ eeprom[MT7986_ADIE1_E3_OFFSET] = read_buf;
++}
++
+ int mt7915_eeprom_init(struct mt7915_dev *dev)
+ {
+ int ret;
+@@ -229,6 +252,8 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+ return ret;
+ }
+
++ mt7915_eeprom_rebonding(dev);
++
+ ret = mt7915_eeprom_load_precal(dev);
+ if (ret)
+ return ret;
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 4e7bc982..dfb1ee69 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2805,7 +2805,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
+ &req, sizeof(req), true);
+ }
+
+-int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
++int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf)
+ {
+ struct mt7915_mcu_eeprom_info req = {
+ .addr = cpu_to_le32(round_down(offset,
+@@ -2822,8 +2822,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+ return ret;
+
+ res = (struct mt7915_mcu_eeprom_info *)skb->data;
+- buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
+- memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
++
++ if (read_buf) {
++ u32 offs = offset % MT7915_EEPROM_BLOCK_SIZE;
++ *read_buf = res->data[offs];
++ } else {
++ buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
++ memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
++ }
++
+ dev_kfree_skb(skb);
+
+ return 0;
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 626b2634..701e5c86 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -562,6 +562,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+
+ int mt7915_register_device(struct mt7915_dev *dev);
+ void mt7915_unregister_device(struct mt7915_dev *dev);
++void mt7915_eeprom_rebonding(struct mt7915_dev *dev);
+ int mt7915_eeprom_init(struct mt7915_dev *dev);
+ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
+ struct mt7915_phy *phy);
+@@ -615,7 +616,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+ struct ieee80211_sta *sta,
+ void *data, u32 field);
+ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
+-int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
++int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf);
+ int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
+ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+ bool hdr_trans);
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
new file mode 100644
index 0000000..97fe88d
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
@@ -0,0 +1,66 @@
+From d8e79f875fb1c569d10c1c214021b1629f4118a3 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Fri, 14 Oct 2022 11:15:13 +0800
+Subject: [PATCH 1128/1128] mt76: mt7915: support on off SW ACI through debugfs
+
+Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Change-Id: I8a9c277c41d1ba76f9737d8af6f42e5e8f00ba64
+---
+ mt76_connac_mcu.h | 1 +
+ mt7915/mtk_debugfs.c | 21 +++++++++++++++++++++
+ 2 files changed, 22 insertions(+)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 131257c7..3b789d75 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1190,6 +1190,7 @@ enum {
+ MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
+ MCU_EXT_CMD_SET_CFG = 0xb7,
+ MCU_EXT_CMD_EDCCA = 0xba,
++ MCU_EXT_CMD_SWLNA_ACI_CTRL = 0xc0,
+ MCU_EXT_CMD_CSI_CTRL = 0xc2,
+ MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
+ };
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index 9a9e0cb6..ddde4961 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -2932,6 +2932,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
+ return 0;
+ }
+
++static int
++mt7915_sw_aci_set(void *data, u64 val)
++{
++#define SWLNA_ENABLE 6
++ struct mt7915_dev *dev = data;
++ struct {
++ u32 subcmd;
++ u8 enable;
++ } req = {
++ .subcmd = SWLNA_ENABLE,
++ .enable = (u8) val,
++ };
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SWLNA_ACI_CTRL), &req, sizeof(req), NULL);
++}
++
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_sw_aci, NULL,
++ mt7915_sw_aci_set, "%llx\n");
++
+ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ {
+ struct mt7915_dev *dev = phy->dev;
+@@ -3014,6 +3033,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+
+ debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
+ mt7915_show_eeprom_mode);
++ debugfs_create_file("sw_aci", 0600, dir, dev,
++ &fops_sw_aci);
+ return 0;
+ }
+ #endif
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
new file mode 100644
index 0000000..0c3111e
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -0,0 +1,120 @@
+From 4e69db534b8abba258baefdd7897907d70234857 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 25 Nov 2022 10:38:53 +0800
+Subject: [PATCH 3001/3010] mt76: mt7915: wed: add wed tx support
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ mt76_connac.h | 1 +
+ mt7915/mac.c | 11 +++++++----
+ mt7915/main.c | 4 ++--
+ mt7915/mmio.c | 5 +++--
+ 4 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/mt76_connac.h b/mt76_connac.h
+index 8ba883b0..f70987dd 100644
+--- a/mt76_connac.h
++++ b/mt76_connac.h
+@@ -116,6 +116,7 @@ struct mt76_connac_sta_key_conf {
+ };
+
+ #define MT_TXP_MAX_BUF_NUM 6
++#define MT_TXD_TXP_BUF_SIZE 128
+
+ struct mt76_connac_fw_txp {
+ __le16 flags;
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index dc4c6eb3..d07bf790 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -890,9 +890,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+
+ txp->token = cpu_to_le16(token_id);
+ txp->nbuf = 1;
+- txp->buf[0] = cpu_to_le32(phys + MT_TXD_SIZE + sizeof(*txp));
++ txp->buf[0] = cpu_to_le32(phys + MT_TXD_TXP_BUF_SIZE);
+
+- return MT_TXD_SIZE + sizeof(*txp);
++ return MT_TXD_TXP_BUF_SIZE;
+ }
+
+ static void
+@@ -1008,6 +1008,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+ LIST_HEAD(free_list);
+ void *end = data + len;
+ bool v3, wake = false;
++ bool with_txwi = true;
+ u16 total, count = 0;
+ u32 txd = le32_to_cpu(free->txd);
+ __le32 *cur_info;
+@@ -1063,12 +1064,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+ txwi = mt76_token_release(mdev, msdu, &wake);
+ if (!txwi)
+ continue;
++ else
++ with_txwi = false;
+
+ mt7915_txwi_free(dev, txwi, sta, &free_list);
+ }
+ }
+-
+- mt7915_mac_tx_free_done(dev, &free_list, wake);
++ if (!with_txwi)
++ mt7915_mac_tx_free_done(dev, &free_list, wake);
+ }
+
+ static void
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 83b97d23..2d237abf 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1505,14 +1505,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+ if (!mtk_wed_device_active(wed))
+ return -ENODEV;
+
+- if (msta->wcid.idx > 0xff)
++ if (msta->wcid.idx > MT7915_WTBL_STA)
+ return -EIO;
+
+ path->type = DEV_PATH_MTK_WDMA;
+ path->dev = ctx->dev;
+ path->mtk_wdma.wdma_idx = wed->wdma_idx;
+ path->mtk_wdma.bss = mvif->mt76.idx;
+- path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? msta->wcid.idx : 0x3ff;
++ path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? 0xff : 0x3ff;
+ path->mtk_wdma.queue = phy != &dev->phy;
+
+ ctx->dev = NULL;
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index fef4b126..7a50aa11 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -11,7 +11,7 @@
+ #include "../trace.h"
+ #include "../dma.h"
+
+-static bool wed_enable;
++static bool wed_enable = true;
+ module_param(wed_enable, bool, 0644);
+ MODULE_PARM_DESC(wed_enable, "Enable Wireless Ethernet Dispatch support");
+
+@@ -580,7 +580,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+ dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
+
+ spin_lock_bh(&dev->mt76.token_lock);
+- dev->mt76.token_size = MT7915_TOKEN_SIZE;
++ dev->mt76.token_size = wed->wlan.token_start;//MT7915_TOKEN_SIZE
+ spin_unlock_bh(&dev->mt76.token_lock);
+
+ /* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
+@@ -783,6 +783,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+
+ *irq = wed->irq;
+ dev->mt76.dma_dev = wed->dev;
++ dev->mt76.token_size = wed->wlan.token_start;
+
+ ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
+ if (ret)
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch
new file mode 100644
index 0000000..ec71b11
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch
@@ -0,0 +1,230 @@
+From b1b86c7f0be6ae9e2ff171f0469c332bf820c849 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Sat, 10 Sep 2022 17:09:21 +0800
+Subject: [PATCH 3002/3010] mt76: mt7915: wed: add-wed-tx-wds-support-on-mt7986
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ mac80211.c | 5 ++++-
+ mt76.h | 2 ++
+ mt7915/init.c | 9 +++++++++
+ mt7915/main.c | 45 +++++++++++++++++++++++++++++++++++++++++++--
+ mt7915/mcu.c | 12 ++++++++++--
+ mt7915/mcu.h | 1 +
+ mt7915/mmio.c | 1 +
+ mt7915/mt7915.h | 4 ++++
+ 8 files changed, 74 insertions(+), 5 deletions(-)
+
+diff --git a/mac80211.c b/mac80211.c
+index 7e0f0e0e..f0ffbd0c 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -1371,7 +1371,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
+
+ mt76_packet_id_flush(dev, wcid);
+
+- mt76_wcid_mask_clear(dev->wcid_mask, idx);
++ if (dev->drv->wed_wds_check && dev->drv->wed_wds_check(dev, sta))
++ mt76_wcid_mask_clear(dev->wcid_wds_mask, idx);
++ else
++ mt76_wcid_mask_clear(dev->wcid_mask, idx);
+ mt76_wcid_mask_clear(dev->wcid_phy_mask, idx);
+ }
+ EXPORT_SYMBOL_GPL(__mt76_sta_remove);
+diff --git a/mt76.h b/mt76.h
+index db2075c3..bb0433b2 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -465,6 +465,7 @@ struct mt76_driver_ops {
+
+ void (*sta_remove)(struct mt76_dev *dev, struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta);
++ bool (*wed_wds_check)(struct mt76_dev *dev, struct ieee80211_sta *sta);
+ };
+
+ struct mt76_channel_state {
+@@ -842,6 +843,7 @@ struct mt76_dev {
+ spinlock_t status_lock;
+
+ u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
++ u32 wcid_wds_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
+ u32 wcid_phy_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
+
+ u64 vif_mask;
+diff --git a/mt7915/init.c b/mt7915/init.c
+index 2f3453b0..8f32b6a8 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -722,6 +722,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+ return ret;
+ }
+
++ /* wds workaround for mt7986 */
++ if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7986(&dev->mt76)) {
++ for(idx = MT7915_WTBL_WDS_START; idx < MT7915_WTBL_WDS_END; idx++)
++ mt76_wcid_mask_set(dev->mt76.wcid_mask, idx);
++
++ for (idx = 0; idx < DIV_ROUND_UP(MT7915_WTBL_STA, 32); idx++)
++ dev->mt76.wcid_wds_mask[idx] = ~dev->mt76.wcid_mask[idx];
++ }
++
+ /* Beacon and mgmt frames should occupy wcid 0 */
+ idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
+ if (idx)
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 2d237abf..8813e3c5 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -658,6 +658,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
+ mutex_unlock(&dev->mt76.mutex);
+ }
+
++bool
++mt7915_wed_wds_check(struct mt76_dev *mdev, struct ieee80211_sta *sta)
++{
++ struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
++
++ if (!mtk_wed_device_active(&mdev->mmio.wed))
++ return false;
++
++ if(!is_mt7986(mdev))
++ return false;
++
++ if((msta->wcid.idx < MT7915_WTBL_WDS_START ||
++ msta->wcid.idx > MT7915_WTBL_WDS_END))
++ return false;
++
++ return true;
++}
++
+ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta)
+ {
+@@ -670,8 +688,18 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ #endif
+ int ret, idx;
+ u32 addr;
++ bool wed_wds = false;
++
++ if (mtk_wed_device_active(&mdev->mmio.wed) && is_mt7986(mdev))
++ wed_wds = !!test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
+
+- idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
++ if (wed_wds)
++ idx = mt76_wcid_alloc(mdev->wcid_wds_mask, MT7915_WTBL_STA);
++ else {
++ idx = mt76_wcid_alloc(mdev->wcid_mask, MT7915_WTBL_STA);
++ if (idx < 0)
++ idx = mt76_wcid_alloc(mdev->wcid_wds_mask, MT7915_WTBL_STA);
++ }
+ if (idx < 0)
+ return -ENOSPC;
+
+@@ -1141,6 +1169,15 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+ else
+ clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
+
++ if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
++ is_mt7986(&dev->mt76) &&
++ (msta->wcid.idx < MT7915_WTBL_WDS_START ||
++ msta->wcid.idx > MT7915_WTBL_WDS_END)) {
++ mt7915_sta_remove(hw, vif, sta);
++ mt76_sta_pre_rcu_remove(hw, vif, sta);
++ mt7915_sta_add(hw, vif, sta);
++ }
++
+ mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
+ }
+
+@@ -1512,7 +1549,11 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+ path->dev = ctx->dev;
+ path->mtk_wdma.wdma_idx = wed->wdma_idx;
+ path->mtk_wdma.bss = mvif->mt76.idx;
+- path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? 0xff : 0x3ff;
++
++ if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags))
++ path->mtk_wdma.wcid = msta->wcid.idx;
++ else
++ path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? 0xff : 0x3ff;
+ path->mtk_wdma.queue = phy != &dev->phy;
+
+ ctx->dev = NULL;
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index dfb1ee69..03fd8c50 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2305,6 +2305,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+ {
+ int ret;
++ struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
+
+ /* force firmware operation mode into normal state,
+ * which should be set before firmware download stage.
+@@ -2334,8 +2335,15 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+ if (ret)
+ return ret;
+
+- if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7915(&dev->mt76))
+- mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
++ if (mtk_wed_device_active(wed)) {
++ if (is_mt7915(&dev->mt76))
++ mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY),
++ 0, 0, 0);
++ else
++ mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
++ MCU_WA_PARAM_WED_VERSION,
++ wed->rev_id, 0);
++ }
+
+ ret = mt7915_mcu_set_mwds(dev, 1);
+ if (ret)
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 9780f128..5fcac90f 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -281,6 +281,7 @@ enum {
+ MCU_WA_PARAM_RED_SHOW_STA = 0xf,
+ MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
+ #endif
++ MCU_WA_PARAM_WED_VERSION = 0x32,
+ };
+
+ enum mcu_mmps_mode {
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 7a50aa11..f348a779 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -991,6 +991,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+ .sta_add = mt7915_mac_sta_add,
+ .sta_remove = mt7915_mac_sta_remove,
+ .update_survey = mt7915_update_channel,
++ .wed_wds_check = mt7915_wed_wds_check,
+ };
+ struct mt7915_dev *dev;
+ struct mt76_dev *mdev;
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 701e5c86..6bc33f21 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -18,6 +18,9 @@
+ #define MT7915_WTBL_STA (MT7915_WTBL_RESERVED - \
+ MT7915_MAX_INTERFACES)
+
++#define MT7915_WTBL_WDS_START 256
++#define MT7915_WTBL_WDS_END 271
++
+ #define MT7915_WATCHDOG_TIME (HZ / 10)
+ #define MT7915_RESET_TIMEOUT (30 * HZ)
+
+@@ -725,6 +728,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
+ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+ struct sk_buff *skb, u32 *info);
+ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
++bool mt7915_wed_wds_check(struct mt76_dev *mdev, struct ieee80211_sta *sta);
+ void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
+ void mt7915_stats_work(struct work_struct *work);
+ int mt76_dfs_start_rdd(struct mt7915_dev *dev, bool force);
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
new file mode 100644
index 0000000..c11071b
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -0,0 +1,70 @@
+From 632b007beff9a0800d2a37d173dee028701ecd02 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 25 Nov 2022 12:05:06 +0800
+Subject: [PATCH 3003/3010] mt76: connac: wed: add wed rx copy skb
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ dma.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index d2891c64..40885754 100644
+--- a/dma.c
++++ b/dma.c
+@@ -382,9 +382,12 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ SKB_WITH_OVERHEAD(q->buf_size),
+ DMA_FROM_DEVICE);
+
+- buf = t->ptr;
++ buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
++ if (!buf)
++ return NULL;
++
++ memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
+ t->dma_addr = 0;
+- t->ptr = NULL;
+
+ mt76_put_rxwi(dev, t);
+
+@@ -578,6 +581,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ while (q->queued < q->ndesc - 1) {
+ struct mt76_txwi_cache *t = NULL;
+ struct mt76_queue_buf qbuf;
++ bool skip_alloc = false;
+ void *buf = NULL;
+
+ if ((q->flags & MT_QFLAG_WED) &&
+@@ -585,11 +589,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ t = mt76_get_rxwi(dev);
+ if (!t)
+ break;
++
++ if (t->ptr) {
++ skip_alloc = true;
++ buf = t->ptr;
++ }
+ }
+
+- buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
+- if (!buf)
+- break;
++ if (!skip_alloc) {
++ buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
++ if (!buf)
++ break;
++ }
+
+ addr = dma_map_single(dev->dma_dev, buf, len, DMA_FROM_DEVICE);
+ if (unlikely(dma_mapping_error(dev->dma_dev, addr))) {
+@@ -954,5 +965,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+
+ if (mtk_wed_device_active(&dev->mmio.wed))
+ mtk_wed_device_detach(&dev->mmio.wed);
++
++ mt76_free_pending_rxwi(dev);
+ }
+ EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
new file mode 100644
index 0000000..e3e0550
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
@@ -0,0 +1,50 @@
+From 1bae1f4f3400ed51d57c315c3c003f352ab5f495 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Thu, 19 May 2022 13:44:42 +0800
+Subject: [PATCH 3004/3010] mt76: mt7915: wed: add fill receive path to report
+ wed idx
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ mt7915/main.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 8813e3c5..52aab3d1 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1560,6 +1560,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+
+ return 0;
+ }
++
++static int
++mt7915_net_fill_receive_path(struct ieee80211_hw *hw,
++ struct net_device_path_ctx *ctx,
++ struct net_device_path *path)
++{
++ struct mt7915_dev *dev = mt7915_hw_dev(hw);
++ struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
++
++ if (!mtk_wed_device_active(wed))
++ return -ENODEV;
++
++ path->dev = ctx->dev;
++ path->mtk_wdma.wdma_idx = wed->wdma_idx;
++
++ return 0;
++}
++
+ #endif
+
+ const struct ieee80211_ops mt7915_ops = {
+@@ -1612,5 +1630,6 @@ const struct ieee80211_ops mt7915_ops = {
+ .set_radar_background = mt7915_set_radar_background,
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ .net_fill_forward_path = mt7915_net_fill_forward_path,
++ .net_fill_receive_path = mt7915_net_fill_receive_path,
+ #endif
+ };
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
new file mode 100644
index 0000000..73feb26
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
@@ -0,0 +1,276 @@
+From 37113fa0b112098fc65ace049e984438629a6c4f Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 25 Nov 2022 14:07:46 +0800
+Subject: [PATCH 3005/3010] mt76: mt7915: wed: add ser support when wed on
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ dma.c | 29 ++++++++++++++++++++---------
+ dma.h | 1 +
+ mt76.h | 1 +
+ mt7915/dma.c | 36 +++++++++++++++++++++++++++++++-----
+ mt7915/mac.c | 18 ++++++++++++++++++
+ mt7915/mmio.c | 3 +++
+ mt7915/mt7915.h | 1 +
+ 7 files changed, 75 insertions(+), 14 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index 40885754..87ce79cb 100644
+--- a/dma.c
++++ b/dma.c
+@@ -165,7 +165,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
+ local_bh_enable();
+ }
+
+-static void
++void
+ mt76_free_pending_rxwi(struct mt76_dev *dev)
+ {
+ struct mt76_txwi_cache *t;
+@@ -178,6 +178,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
+ }
+ local_bh_enable();
+ }
++EXPORT_SYMBOL_GPL(mt76_free_pending_rxwi);
+
+ static void
+ mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -623,14 +624,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ return frames;
+ }
+
+-static int
+-mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
++int
++mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+ {
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ struct mtk_wed_device *wed = &dev->mmio.wed;
+ int ret, type, ring;
+- u8 flags = q->flags;
++ u8 flags;
+
++ if (!q || !q->ndesc)
++ return -EINVAL;
++
++ flags = q->flags;
+ if (!mtk_wed_device_active(wed))
+ q->flags &= ~MT_QFLAG_WED;
+
+@@ -642,7 +647,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+
+ switch (type) {
+ case MT76_WED_Q_TX:
+- ret = mtk_wed_device_tx_ring_setup(wed, ring, q->regs);
++ ret = mtk_wed_device_tx_ring_setup(wed, ring, q->regs, reset);
+ if (!ret)
+ q->wed_regs = wed->tx_ring[ring].reg_base;
+ break;
+@@ -658,7 +663,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+ q->wed_regs = wed->txfree_ring.reg_base;
+ break;
+ case MT76_WED_Q_RX:
+- ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs);
++ ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs, reset);
+ if (!ret)
+ q->wed_regs = wed->rx_ring[ring].reg_base;
+ break;
+@@ -671,6 +676,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+ return 0;
+ #endif
+ }
++EXPORT_SYMBOL_GPL(mt76_dma_wed_setup);
+
+ static int
+ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -697,7 +703,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+ if (!q->entry)
+ return -ENOMEM;
+
+- ret = mt76_dma_wed_setup(dev, q);
++ ret = mt76_dma_wed_setup(dev, q, false);
+ if (ret)
+ return ret;
+
+@@ -748,8 +754,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+ q->desc[i].ctrl = cpu_to_le32(MT_DMA_CTL_DMA_DONE);
+
+ mt76_dma_rx_cleanup(dev, q);
+- mt76_dma_sync_idx(dev, q);
+- mt76_dma_rx_fill(dev, q);
++
++ mt76_dma_wed_setup(dev, q, true);
++
++ if (q->flags != MT_WED_Q_TXFREE) {
++ mt76_dma_sync_idx(dev, q);
++ mt76_dma_rx_fill(dev, q);
++ }
+
+ if (!q->rx_head)
+ return;
+diff --git a/dma.h b/dma.h
+index 53c6ce25..4b9bc7f4 100644
+--- a/dma.h
++++ b/dma.h
+@@ -56,5 +56,6 @@ enum mt76_mcu_evt_type {
+ int mt76_dma_rx_poll(struct napi_struct *napi, int budget);
+ void mt76_dma_attach(struct mt76_dev *dev);
+ void mt76_dma_cleanup(struct mt76_dev *dev);
++int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset);
+
+ #endif
+diff --git a/mt76.h b/mt76.h
+index bb0433b2..cca8986f 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -1380,6 +1380,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+ void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
+ void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
+ struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
++void mt76_free_pending_rxwi(struct mt76_dev *dev);
+ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
+ struct napi_struct *napi);
+ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
+diff --git a/mt7915/dma.c b/mt7915/dma.c
+index 27b67800..03563919 100644
+--- a/mt7915/dma.c
++++ b/mt7915/dma.c
+@@ -562,6 +562,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
+ {
+ struct mt76_phy *mphy_ext = dev->mt76.phys[MT_BAND1];
++ struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
+ int i;
+
+ /* clean up hw queues */
+@@ -581,28 +582,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
+ if (force)
+ mt7915_wfsys_reset(dev);
+
++ if (mtk_wed_device_active(&dev->mt76.mmio.wed))
++ mtk_wed_device_dma_reset(&dev->mt76.mmio.wed);
+ mt7915_dma_disable(dev, force);
+
++ /* set wifi reset done, wait FE reset */
++ if (mtk_wed_device_active(wed) && atomic_read(&wed->fe_reset)) {
++ atomic_set(&wed->fe_reset, 0);
++ rtnl_lock();
++ complete(&wed->wlan_reset_done);
++ rtnl_unlock();
++ wait_for_completion(&wed->fe_reset_done);
++ }
++
+ /* reset hw queues */
+ for (i = 0; i < __MT_TXQ_MAX; i++) {
+ mt76_queue_reset(dev, dev->mphy.q_tx[i]);
+- if (mphy_ext)
++ if (mphy_ext) {
+ mt76_queue_reset(dev, mphy_ext->q_tx[i]);
++ if (mtk_wed_device_active(wed))
++ mt76_dma_wed_setup(&dev->mt76,
++ mphy_ext->q_tx[i],
++ true);
++ }
++ if (mtk_wed_device_active(wed))
++ mt76_dma_wed_setup(&dev->mt76, dev->mphy.q_tx[i],
++ true);
+ }
+
+ for (i = 0; i < __MT_MCUQ_MAX; i++)
+ mt76_queue_reset(dev, dev->mt76.q_mcu[i]);
+
+- mt76_for_each_q_rx(&dev->mt76, i)
+- mt76_queue_reset(dev, &dev->mt76.q_rx[i]);
++ mt76_for_each_q_rx(&dev->mt76, i) {
++ if (dev->mt76.q_rx[i].flags != MT_WED_Q_TXFREE)
++ mt76_queue_reset(dev, &dev->mt76.q_rx[i]);
++ }
+
+ mt76_tx_status_check(&dev->mt76, true);
+
+- mt7915_dma_enable(dev);
+-
+ mt76_for_each_q_rx(&dev->mt76, i)
+ mt76_queue_rx_reset(dev, i);
+
++ if(mtk_wed_device_active(wed) && is_mt7915(&dev->mt76))
++ mt76_rmw(dev, MT_WFDMA0_EXT0_CFG, MT_WFDMA0_EXT0_RXWB_KEEP,
++ MT_WFDMA0_EXT0_RXWB_KEEP);
++
++ mt7915_dma_enable(dev);
++
+ return 0;
+ }
+
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index d07bf790..f72e2bc2 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -895,6 +895,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+ return MT_TXD_TXP_BUF_SIZE;
+ }
+
++void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
++{
++ struct mt7915_dev *dev;
++ u8 band_idx;
++ dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
++ band_idx = dev->phy.band_idx;
++
++ mt7915_mcu_set_ser(dev, SER_RECOVER, 1, band_idx);
++
++ return;
++}
++
+ static void
+ mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
+ {
+@@ -1633,6 +1645,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
+ return;
+
++ if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
++ mtk_wed_device_stop(&dev->mt76.mmio.wed, true);
++ if (!is_mt7986(&dev->mt76))
++ mt76_wr(dev, MT_INT_WED_MASK_CSR, 0);
++ }
++
+ ieee80211_stop_queues(mt76_hw(dev));
+ if (ext_phy)
+ ieee80211_stop_queues(ext_phy->hw);
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index f348a779..f5dfee37 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -617,6 +617,8 @@ static void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
+ mt76_put_rxwi(&dev->mt76, t);
+ }
+
++ mt76_free_pending_rxwi(&dev->mt76);
++
+ if (!wed->rx_buf_ring.rx_page.va)
+ return;
+
+@@ -775,6 +777,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ wed->wlan.init_rx_buf = mt7915_wed_init_rx_buf;
+ wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
+ wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
++ wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
+
+ dev->mt76.rx_token_size = wed->wlan.rx_npkt;
+
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 6bc33f21..ec61941e 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -562,6 +562,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
+ u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
+ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
++void mt7915_wed_trigger_ser(struct mtk_wed_device *wed);
+
+ int mt7915_register_device(struct mt7915_dev *dev);
+ void mt7915_unregister_device(struct mt7915_dev *dev);
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
new file mode 100644
index 0000000..bebd7ea
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
@@ -0,0 +1,146 @@
+From f6b59719aef1daa47df3ea5da4fb30c09505f9fe Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Fri, 2 Sep 2022 14:40:40 +0800
+Subject: [PATCH 3006/3010] mt76: mt7915: wed: enable red per-band token drop
+ for HW Path
+
+Limit the number of token used by each band. If a band uses too many token,
+it may hurt the throughput of the other band. The SW path can solve this
+problem by AQL.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7915/mcu.c | 53 +++++++++++++++++++++++++++++++++++++++----------
+ mt7915/mcu.h | 1 +
+ mt7915/mt7915.h | 3 ++-
+ 3 files changed, 46 insertions(+), 11 deletions(-)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 03fd8c50..e6826c60 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2343,8 +2343,13 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+ mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
+ MCU_WA_PARAM_WED_VERSION,
+ wed->rev_id, 0);
++
++ mt7915_mcu_set_red(dev, true);
++ } else {
++ mt7915_mcu_set_red(dev, false);
+ }
+
++
+ ret = mt7915_mcu_set_mwds(dev, 1);
+ if (ret)
+ return ret;
+@@ -2354,12 +2359,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+ if (ret)
+ return ret;
+
+- ret = mt7915_mcu_init_rx_airtime(dev);
+- if (ret)
+- return ret;
+-
+- return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
+- MCU_WA_PARAM_RED, 0, 0);
++ return mt7915_mcu_init_rx_airtime(dev);
+ }
+
+ int mt7915_mcu_init(struct mt7915_dev *dev)
+@@ -4429,6 +4429,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
+
+ return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
+ }
++#endif
++
++static int mt7915_red_set_watermark(struct mt7915_dev *dev)
++{
++#define RED_GLOBAL_TOKEN_WATERMARK 2
++#define TOTAL_HW_TOKEN_SIZE 8192
++ struct {
++ __le32 args[3];
++
++ u8 cmd;
++ u8 version;
++ u8 __rsv1[4];
++ u16 len;
++
++ __le16 high_mark;
++ __le16 low_mark;
++ u8 __rsv2[12];
++ } req = {
++ .args[0] = cpu_to_le32(MCU_WA_PARAM_RED_SETTING),
++ .cmd = RED_GLOBAL_TOKEN_WATERMARK,
++ .len = cpu_to_le16(sizeof(req) - 12),
++
++ .high_mark = cpu_to_le16(TOTAL_HW_TOKEN_SIZE - 256),
++ .low_mark = cpu_to_le16(TOTAL_HW_TOKEN_SIZE - 256 - 1536),
++ };
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
++ sizeof(req), false);
++}
+
+ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+ {
+@@ -4439,17 +4468,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+ u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
+ __le32 req = cpu_to_le32(red_type);
+
++ if (enabled) {
++ ret = mt7915_red_set_watermark(dev);
++ if (ret < 0)
++ return ret;
++ }
++
+ ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
+ sizeof(req), false);
+ if (ret < 0)
+ return ret;
+
+- mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
+- MCU_WA_PARAM_RED, enabled, 0, true);
++ return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
++ MCU_WA_PARAM_RED, enabled, 0);
+
+- return 0;
+ }
+-#endif
+
+ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+ {
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 5fcac90f..f9fb4137 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -282,6 +282,7 @@ enum {
+ MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
+ #endif
+ MCU_WA_PARAM_WED_VERSION = 0x32,
++ MCU_WA_PARAM_RED_SETTING = 0x40,
+ };
+
+ enum mcu_mmps_mode {
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index ec61941e..3930c441 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -774,13 +774,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+ #endif
+ int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
+ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
++int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled);
++
+ int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
+ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
+
+ #ifdef MTK_DEBUG
+ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
+ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
+-int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled);
+ void mt7915_dump_tmac_info(u8 *tmac_info);
+ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
+ void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
new file mode 100644
index 0000000..c8ae556
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
@@ -0,0 +1,91 @@
+From 0574a0f51cbecfee460a73a6f1764357a9f20baa Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Thu, 22 Sep 2022 09:54:53 +0800
+Subject: [PATCH 3007/3010] mt76: mt7915: wed: update mt7916 trinfo when hw
+ path enable
+
+---
+ mt7915/mt7915_debug.h | 10 ++++++++++
+ mt7915/mtk_debugfs.c | 16 +++++++++++++---
+ 2 files changed, 23 insertions(+), 3 deletions(-)
+
+diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
+index ecdc02ab..0a1ee808 100644
+--- a/mt7915/mt7915_debug.h
++++ b/mt7915/mt7915_debug.h
+@@ -133,6 +133,8 @@ enum dbg_reg_rev {
+ DBG_MIB_M0ARNG0,
+ DBG_MIB_M0DR2,
+ DBG_MIB_M0DR13,
++ DBG_WFDMA_WED_TX_CTRL,
++ DBG_WFDMA_WED_RX_CTRL,
+ __MT_DBG_REG_REV_MAX,
+ };
+
+@@ -177,6 +179,8 @@ static const u32 mt7986_dbg_base[] = {
+
+ /* mt7915 regs with different base and offset */
+ static const struct __dbg_reg mt7915_dbg_reg[] = {
++ [DBG_WFDMA_WED_TX_CTRL] = { MT_DBG_WFDMA_EXT_CSR_BASE, 0x300 },
++ [DBG_WFDMA_WED_RX_CTRL] = { MT_DBG_WFDMA_EXT_CSR_BASE, 0x400 },
+ [DBG_INT_SOURCE_CSR] = { MT_DBG_WFDMA_EXT_CSR_BASE, 0x10 },
+ [DBG_INT_MASK_CSR] = { MT_DBG_WFDMA_EXT_CSR_BASE, 0x14 },
+ [DBG_INT1_SOURCE_CSR] = { MT_DBG_WFDMA_EXT_CSR_BASE, 0x88 },
+@@ -281,6 +285,8 @@ static const struct __dbg_reg mt7915_dbg_reg[] = {
+
+ /* mt7986/mt7916 regs with different base and offset */
+ static const struct __dbg_reg mt7916_dbg_reg[] = {
++ [DBG_WFDMA_WED_TX_CTRL] = { MT_DBG_WFDMA_EXT_CSR_BASE, 0x300 },
++ [DBG_WFDMA_WED_RX_CTRL] = { MT_DBG_WFDMA_EXT_CSR_BASE, 0x400 },
+ [DBG_INT_SOURCE_CSR] = { MT_DBG_WFDMA0_BASE, 0x200 },
+ [DBG_INT_MASK_CSR] = { MT_DBG_WFDMA0_BASE, 0x204 },
+ [DBG_INT1_SOURCE_CSR] = { MT_DBG_WFDMA0_PCIE1_BASE, 0x200 },
+@@ -450,11 +456,15 @@ struct bin_debug_hdr {
+ #define MT_DBG_RX_EVENT_RING_BASE __DBG_REG(dev, DBG_RX_EVENT_RING_BASE)
+ #define MT_DBG_RX_STS_RING_BASE __DBG_REG(dev, DBG_RX_STS_RING_BASE)
+ #define MT_DBG_RX_DATA_RING_BASE __DBG_REG(dev, DBG_RX_DATA_RING_BASE)
++#define MT_DBG_WFDMA_WED_TX_CTRL_BASE __DBG_REG(dev, DBG_WFDMA_WED_TX_CTRL)
++#define MT_DBG_WFDMA_WED_RX_CTRL_BASE __DBG_REG(dev, DBG_WFDMA_WED_RX_CTRL)
+
+ #define MT_DBG_TX_RING_CTRL(n) (MT_DBG_TX_RING_BASE + (0x10 * (n)))
+ #define MT_DBG_RX_DATA_RING_CTRL(n) (MT_DBG_RX_DATA_RING_BASE + (0x10 * (n)))
+ #define MT_DBG_RX_EVENT_RING_CTRL(n) (MT_DBG_RX_EVENT_RING_BASE + (0x10 * (n)))
+
++#define MT_DBG_WFDMA_WED_TX_CTRL(n) (MT_DBG_WFDMA_WED_TX_CTRL_BASE + (0x10 * (n)))
++#define MT_DBG_WFDMA_WED_RX_CTRL(n) (MT_DBG_WFDMA_WED_RX_CTRL_BASE + (0x10 * (n)))
+ /* WFDMA COMMON */
+ #define MT_DBG_INT_SOURCE_CSR __DBG_REG(dev, DBG_INT_SOURCE_CSR)
+ #define MT_DBG_INT_MASK_CSR __DBG_REG(dev, DBG_INT_MASK_CSR)
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index ddde4961..61996085 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -856,12 +856,22 @@ mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
+ "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
+ dump_dma_tx_ring_info(s, dev, "T16:FWDL", MT_DBG_TX_RING_CTRL(0));
+ dump_dma_tx_ring_info(s, dev, "T17:Cmd(H2WM)", MT_DBG_TX_RING_CTRL(1));
+- dump_dma_tx_ring_info(s, dev, "T18:TXD0(H2WA)", MT_DBG_TX_RING_CTRL(2));
+- dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)", MT_DBG_TX_RING_CTRL(3));
++
++ if (is_mt7916(&dev->mt76) && mtk_wed_device_active(&dev->mt76.mmio.wed)) {
++ dump_dma_tx_ring_info(s, dev, "T18:TXD0(H2WA)", MT_DBG_WFDMA_WED_TX_CTRL(0));
++ dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)", MT_DBG_WFDMA_WED_TX_CTRL(1));
++ } else {
++ dump_dma_tx_ring_info(s, dev, "T18:TXD0(H2WA)", MT_DBG_TX_RING_CTRL(2));
++ dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)", MT_DBG_TX_RING_CTRL(3));
++ }
++
+ dump_dma_tx_ring_info(s, dev, "T20:Cmd(H2WA)", MT_DBG_TX_RING_CTRL(4));
+ dump_dma_rx_ring_info(s, dev, "R0:Event(WM2H)", MT_DBG_RX_DATA_RING_CTRL(0));
+ dump_dma_rx_ring_info(s, dev, "R1:Event(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(1));
+- dump_dma_rx_ring_info(s, dev, "R2:TxDone(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(2));
++ if (is_mt7916(&dev->mt76) && mtk_wed_device_active(&dev->mt76.mmio.wed))
++ dump_dma_rx_ring_info(s, dev, "R2:TxDone(WA2H)", MT_DBG_WFDMA_WED_RX_CTRL(1));
++ else
++ dump_dma_rx_ring_info(s, dev, "R2:TxDone(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(2));
+ dump_dma_rx_ring_info(s, dev, "R3:TxDone1(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(3));
+ dump_dma_rx_ring_info(s, dev, "R4:Data0(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(0));
+ dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(1));
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
new file mode 100644
index 0000000..3d6380a
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
@@ -0,0 +1,52 @@
+From c02c4712a0513109f0983a421a9742da1c761a21 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 25 Nov 2022 14:32:35 +0800
+Subject: [PATCH 3008/3010] mt76: mt7915: wed: find rx token by physical
+ address
+
+The token id in RxDMAD may be incorrect when it is not the last frame due to
+WED HW bug. Lookup correct token id by physical address in sdp0.
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ dma.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/dma.c b/dma.c
+index 87ce79cb..ddc804a5 100644
+--- a/dma.c
++++ b/dma.c
+@@ -372,10 +372,29 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+
+ if ((q->flags & MT_QFLAG_WED) &&
+ FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
++ u32 id, find = 0;
+ u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
+ le32_to_cpu(desc->buf1));
+- struct mt76_txwi_cache *t = mt76_rx_token_release(dev, token);
++ struct mt76_txwi_cache *t;
++
++ if (*more) {
++ spin_lock_bh(&dev->rx_token_lock);
++
++ idr_for_each_entry(&dev->rx_token, t, id) {
++ if (t->dma_addr == le32_to_cpu(desc->buf0)) {
++ find = 1;
++ desc->buf1 = FIELD_PREP(MT_DMA_CTL_TOKEN, id);
++ token = id;
++ break;
++ }
++ }
++
++ spin_unlock_bh(&dev->rx_token_lock);
++ if (!find)
++ return NULL;
++ }
+
++ t = mt76_rx_token_release(dev, token);
+ if (!t)
+ return NULL;
+
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
new file mode 100644
index 0000000..0b3581d
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
@@ -0,0 +1,58 @@
+From 504f797dfcca7ff11c1ab1698a92c0ef545bae89 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 25 Nov 2022 14:37:58 +0800
+Subject: [PATCH 3009/3010] mt76: mt7915: wed: drop scatter and gather frame
+
+The scatter and gather frame may be incorrect because WED and WO may
+send frames to host driver interleaved.
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ dma.c | 5 +++++
+ dma.h | 1 +
+ mt76.h | 1 +
+ 3 files changed, 7 insertions(+)
+
+diff --git a/dma.c b/dma.c
+index ddc804a5..fec9d090 100644
+--- a/dma.c
++++ b/dma.c
+@@ -416,6 +416,11 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+
+ *drop = !!(ctrl & (MT_DMA_CTL_TO_HOST_A |
+ MT_DMA_CTL_DROP));
++
++ if (!(*more) && FIELD_GET(MT_DMA_CTL_WO, desc->buf1))
++ q->flags &= ~MT_QFLAG_WED_FRAG;
++ else
++ q->flags |= MT_QFLAG_WED_FRAG;
+ }
+ } else {
+ buf = e->buf;
+diff --git a/dma.h b/dma.h
+index 4b9bc7f4..ce8ac426 100644
+--- a/dma.h
++++ b/dma.h
+@@ -19,6 +19,7 @@
+ #define MT_DMA_CTL_TO_HOST_A BIT(12)
+ #define MT_DMA_CTL_DROP BIT(14)
+ #define MT_DMA_CTL_TOKEN GENMASK(31, 16)
++#define MT_DMA_CTL_WO BIT(8)
+
+ #define MT_DMA_PPE_CPU_REASON GENMASK(15, 11)
+ #define MT_DMA_PPE_ENTRY GENMASK(30, 16)
+diff --git a/mt76.h b/mt76.h
+index cca8986f..43594102 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -30,6 +30,7 @@
+ #define MT_QFLAG_WED_RING GENMASK(1, 0)
+ #define MT_QFLAG_WED_TYPE GENMASK(3, 2)
+ #define MT_QFLAG_WED BIT(4)
++#define MT_QFLAG_WED_FRAG BIT(5)
+
+ #define __MT_WED_Q(_type, _n) (MT_QFLAG_WED | \
+ FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
new file mode 100644
index 0000000..ced7af9
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -0,0 +1,1015 @@
+From 053443a80970f7a586fb76a7a889c7ca091dcc32 Mon Sep 17 00:00:00 2001
+From: Lian Chen <lian.chen@mediatek.com>
+Date: Mon, 7 Nov 2022 14:47:44 +0800
+Subject: [PATCH 3010/3010] mt76: mt7915: wed: HW ATF support for mt7986
+
+Signed-off-by: Lian Chen <lian.chen@mediatek.com>
+---
+ mt76_connac_mcu.h | 2 +
+ mt7915/debugfs.c | 405 +++++++++++++++++++++++++++++++++++++++++++
+ mt7915/init.c | 39 +++++
+ mt7915/main.c | 16 ++
+ mt7915/mcu.c | 165 ++++++++++++++++++
+ mt7915/mt7915.h | 68 ++++++++
+ mt7915/mtk_debugfs.c | 133 +++++++++++++-
+ 7 files changed, 827 insertions(+), 1 deletion(-)
+ mode change 100644 => 100755 mt7915/init.c
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 3b789d75..eb17a015 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1148,6 +1148,7 @@ enum {
+ MCU_EXT_CMD_THERMAL_CTRL = 0x2c,
+ MCU_EXT_CMD_WTBL_UPDATE = 0x32,
+ MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
++ MCU_EXT_CMD_SET_FEATURE_CTRL = 0x38,
+ MCU_EXT_CMD_SET_RDD_CTRL = 0x3a,
+ MCU_EXT_CMD_ATE_CTRL = 0x3d,
+ MCU_EXT_CMD_PROTECT_CTRL = 0x3e,
+@@ -1157,6 +1158,7 @@ enum {
+ MCU_EXT_CMD_MUAR_UPDATE = 0x48,
+ MCU_EXT_CMD_BCN_OFFLOAD = 0x49,
+ MCU_EXT_CMD_RX_AIRTIME_CTRL = 0x4a,
++ MCU_EXT_CMD_AT_PROC_MODULE = 0x4b,
+ MCU_EXT_CMD_SET_RX_PATH = 0x4e,
+ MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
+ MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
+diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
+index 092d8434..79a29ee8 100644
+--- a/mt7915/debugfs.c
++++ b/mt7915/debugfs.c
+@@ -12,6 +12,10 @@
+ #define FW_BIN_LOG_MAGIC_V2 0x44d9c99a
+ #endif
+
++#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
++#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
++
++
+ /** global debugfs **/
+
+ struct hw_queue_map {
+@@ -211,6 +215,406 @@ static const struct file_operations mt7915_sys_recovery_ops = {
+ .llseek = default_llseek,
+ };
+
++static ssize_t mt7915_vow_get(struct file *file, char __user *user_buf,
++ size_t count, loff_t *ppos)
++{
++ char *buff;
++ int desc = 0;
++ ssize_t ret;
++ static const size_t bufsz = 1000;
++
++ buff = kmalloc(bufsz, GFP_KERNEL);
++ if (!buff)
++ return -ENOMEM;
++
++ desc += scnprintf(buff + desc, bufsz - desc,
++ "======== Control =============\n"
++ "vow_atf_en=<0/1> 0:disable, 1:enable\n"
++ "vow_watf_en=<0/1> 0:disable, 1:enable\n"
++ "vow_watf_quantum=<level>-<quantum> unit 256us\n"
++ "======== Station table =============\n"
++ "vow_sta_dwrr_quantum_id=<wlanidx>-<WMM AC>-<Qid>\n"
++ "vow_dwrr_max_wait_time=<time> 256us\n"
++ "======== Debug =============\n"
++ "vow_show_en=<0/1> 0:dieable, 1:enable\n"
++ "vow_show_sta=<STA num>\n"
++ "show_vow_info\n"
++ "show_vow_sta_conf=<STA num> 0:all\n");
++ ret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);
++ kfree(buff);
++ return ret;
++}
++
++static int mt7915_set_vow_sta_dwrr_quantum_id(struct mt7915_dev *dev,
++ u32 wcid_id,
++ u32 ac, u32 val)
++{
++ struct mt7915_sta *msta;
++ struct mt76_wcid *wcid;
++ int ret;
++
++ wcid = rcu_dereference(dev->mt76.wcid[wcid_id]);
++ if ((!wcid) || (!wcid->sta)) {
++ dev_err(dev->mt76.dev, "%s: error station.\n", __func__);
++ return 0;
++ }
++
++ msta = container_of(wcid, struct mt7915_sta, wcid);
++
++ msta->vow_sta_cfg.dwrr_quantum[ac] = val;
++
++ ret = mt7915_mcu_set_vow_drr_ctrl(dev, msta, VOW_DRR_STA_AC0_QUA_ID + ac);
++ dev_info(dev->mt76.dev, "%s: set sta %d, ac %d, quantum id %u.\n",
++ __func__, wcid_id, ac, val);
++
++ return ret;
++}
++
++static int mt7915_set_vow_atf_en(struct mt7915_dev *dev, u32 val)
++{
++ int ret;
++
++ dev->vow_cfg.vow_atf_en = !!val;
++ dev->vow_cfg.sta_max_wait_time = val ? 0x40 : 0x1;
++ ret = mt7915_mcu_set_vow_feature_ctrl(dev);
++ dev_info(dev->mt76.dev, "%s: set vow_atf_en %u.\n",
++ __func__, val);
++
++ ret = mt7915_mcu_set_vow_drr_ctrl(dev, NULL,
++ VOW_DRR_AIRTIME_DEFICIT_BOUND);
++ dev_info(dev->mt76.dev, "%s: set vow_dwrr_max_wait_time %u.\n",
++ __func__, dev->vow_cfg.sta_max_wait_time);
++
++ return ret;
++}
++
++static int mt7915_set_vow_dwrr_max_wait_time(struct mt7915_dev *dev,
++ u32 val)
++{
++ int ret;
++
++ dev->vow_cfg.sta_max_wait_time = val;
++ ret = mt7915_mcu_set_vow_drr_ctrl(dev, NULL,
++ VOW_DRR_AIRTIME_DEFICIT_BOUND);
++ dev_info(dev->mt76.dev, "%s: set vow_dwrr_max_wait_time %u.\n",
++ __func__, val);
++
++ return ret;
++}
++
++static int mt7915_set_vow_watf_en(struct mt7915_dev *dev, u32 val)
++{
++ int ret;
++
++ dev->vow_cfg.vow_watf_en = !!val;
++ ret = mt7915_mcu_set_vow_feature_ctrl(dev);
++ dev_info(dev->mt76.dev, "%s: set vow_watf_en %u.\n", __func__, val);
++
++ return ret;
++}
++
++static int mt7915_set_vow_watf_quantum(struct mt7915_dev *dev,
++ u32 id, u32 val)
++{
++ int ret;
++
++ dev->vow_cfg.vow_sta_dwrr_quantum[id] = val;
++ ret = mt7915_mcu_set_vow_drr_ctrl(dev, NULL,
++ VOW_DRR_AIRTIME_QUANTUM_L0 + id);
++ dev_info(dev->mt76.dev, "%s: set quantum id %u, val %d.\n",
++ __func__, id, val);
++
++ return ret;
++}
++
++extern int mt7915_vow_pleinfo_read(struct mt7915_dev *dev);
++static void mt7915_show_station_tx_airtime(struct work_struct *work){
++ struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
++ vow_work.work);
++ static u32 vow_last_tx_time[MT7916_WTBL_SIZE];
++ struct ieee80211_sta *ieee80211_sta;
++ struct mt7915_sta *msta;
++ struct mt76_wcid *wcid;
++ int idx = 0;
++ int i = 0;
++ u32 addr;
++ int tx_airtime_sum = 0;
++ int tx_add_airtime = 0;
++
++ if (!dev->vow_cfg.vow_show_en)
++ return;
++
++ rcu_read_lock();
++ for (idx = 1; (idx < dev->vow_cfg.vow_show_sta) &&
++ (idx < MT7915_WTBL_STA); idx++) {
++ if (idx >= ARRAY_SIZE(dev->mt76.wcid))
++ return;
++
++ wcid = rcu_dereference(dev->mt76.wcid[idx]);
++ if (!wcid || !wcid->sta)
++ continue;
++
++ msta = container_of(wcid, struct mt7915_sta, wcid);
++ addr = mt7915_mac_wtbl_lmac_addr(dev, idx, 20);
++ tx_airtime_sum = 0;
++
++ for (i = 0; i < IEEE80211_NUM_ACS; i++) {
++ tx_airtime_sum += mt76_rr(dev, addr);
++ addr += 8;
++ }
++ tx_add_airtime = tx_airtime_sum - vow_last_tx_time[idx];
++ vow_last_tx_time[idx] = tx_airtime_sum;
++
++ ieee80211_sta = container_of((void *)msta, struct ieee80211_sta,
++ drv_priv);
++
++ dev_info(dev->mt76.dev, "sta%u:" MACSTR " tx -> %u)\n",
++ idx, MAC2STR(ieee80211_sta->addr), tx_add_airtime);
++ }
++ mt7915_vow_pleinfo_read(dev);
++ ieee80211_queue_delayed_work(mt76_hw(dev), &dev->vow_work, 1 * HZ);
++ rcu_read_unlock();
++ return;
++}
++
++
++static int mt7915_set_vow_show_en(struct mt7915_dev *dev, u32 val)
++{
++ if (!!dev->vow_cfg.vow_show_en == !!val)
++ return 0;
++ dev->vow_cfg.vow_show_en = val;
++ mt7915_mcu_set_vow_feature_ctrl(dev);
++ if (dev->vow_cfg.vow_show_en) {
++ INIT_DELAYED_WORK(&dev->vow_work, mt7915_show_station_tx_airtime);
++ ieee80211_queue_delayed_work(mt76_hw(dev), &dev->vow_work, 1 * HZ);
++ }
++ else {
++ cancel_delayed_work_sync(&dev->vow_work);
++ }
++ return 0;
++}
++
++static int mt7915_set_vow_show_sta(struct mt7915_dev *dev, u32 val)
++{
++ dev->vow_cfg.vow_show_sta = val;
++ dev_info(dev->mt76.dev, "%s: show station up to %d.\n",
++ __func__, dev->vow_cfg.vow_show_sta);
++ return 0;
++}
++static int mt7915_set_show_vow_info(struct mt7915_dev *dev)
++{
++ dev_info(dev->mt76.dev, "====== VOW Control Information ======\n");
++ dev_info(dev->mt76.dev, "ATF Enbale: %d\n",
++ dev->vow_cfg.vow_atf_en);
++ dev_info(dev->mt76.dev, "WATF Enable: %d\n",
++ dev->vow_cfg.vow_watf_en);
++ dev_info(dev->mt76.dev, "refill_period: %d\n",
++ dev->vow_cfg.refill_period);
++ dev_info(dev->mt76.dev, "===== VOW Max Deficit Information =====\n");
++ dev_info(dev->mt76.dev, "VOW Max Deficit(unit 256us): %d\n",
++ dev->vow_cfg.sta_max_wait_time);
++ dev_info(dev->mt76.dev, "===== VOW Quantum Information =====\n");
++ dev_info(dev->mt76.dev, "Quantum ID 0 value(unit 256us): %d\n",
++ dev->vow_cfg.vow_sta_dwrr_quantum[0]);
++ dev_info(dev->mt76.dev, "Quantum ID 1 value(unit 256us): %d\n",
++ dev->vow_cfg.vow_sta_dwrr_quantum[1]);
++ dev_info(dev->mt76.dev, "Quantum ID 2 value(unit 256us): %d\n",
++ dev->vow_cfg.vow_sta_dwrr_quantum[2]);
++ dev_info(dev->mt76.dev, "Quantum ID 3 value(unit 256us): %d\n",
++ dev->vow_cfg.vow_sta_dwrr_quantum[3]);
++ return 0;
++}
++
++static int mt7915_show_vow_sta_conf(struct mt7915_dev *dev, u32 val)
++{
++ struct ieee80211_sta *ieee80211_sta;
++ struct mt7915_sta *msta;
++ struct mt76_wcid *wcid;
++ u32 i;
++ u8 q;
++
++ if (val > 0 && val < MT7915_WTBL_STA) {
++ wcid = rcu_dereference(dev->mt76.wcid[val]);
++ if (!wcid || !wcid->sta)
++ return 0;
++ msta = container_of(wcid, struct mt7915_sta, wcid);
++ ieee80211_sta = container_of((void *)msta, struct ieee80211_sta,
++ drv_priv);
++ dev_info(dev->mt76.dev, "%s: ****** sta%d: "MACSTR"******\n",
++ __func__, val, MAC2STR(ieee80211_sta->addr));
++ q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VO];
++ dev_info(dev->mt76.dev, "Ac0 --> %uus(%u)\n",
++ (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
++ q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VI];
++ dev_info(dev->mt76.dev, "Ac1 --> %uus(%u)\n",
++ (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
++ q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BE];
++ dev_info(dev->mt76.dev, "Ac2 --> %uus(%u)\n",
++ (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
++ q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BK];
++ dev_info(dev->mt76.dev, "Ac3 --> %uus(%u)\n",
++ (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
++ }
++ else{
++ for (i = 1; i < MT7915_WTBL_STA; i++) {
++ wcid = rcu_dereference(dev->mt76.wcid[i]);
++ if (!wcid || !wcid->sta)
++ continue;
++ msta = container_of(wcid, struct mt7915_sta, wcid);
++ ieee80211_sta = container_of((void *)msta, struct ieee80211_sta,
++ drv_priv);
++ dev_info(dev->mt76.dev, "%s: ****** sta%d: "MACSTR"******\n",
++ __func__, i, MAC2STR(ieee80211_sta->addr));
++ q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VO];
++ dev_info(dev->mt76.dev, "Ac0 --> %uus(%u)\n",
++ (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
++ q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VI];
++ dev_info(dev->mt76.dev, "Ac1 --> %uus(%u)\n",
++ (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
++ q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BE];
++ dev_info(dev->mt76.dev, "Ac2 --> %uus(%u)\n",
++ (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
++ q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BK];
++ dev_info(dev->mt76.dev, "Ac3 --> %uus(%u)\n",
++ (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
++ }
++ }
++ return 0;
++}
++
++static ssize_t
++mt7915_vow_set(struct file *file, const char __user *user_buf,
++ size_t count, loff_t *ppos)
++{
++ struct mt7915_phy *phy = file->private_data;
++ struct mt7915_dev *dev = phy->dev;
++ u32 rv, param1, param2, param3;
++ char buf[128];
++ int ret = 0;
++
++ if (count >= sizeof(buf))
++ return -EINVAL;
++
++ if (copy_from_user(buf, user_buf, count))
++ return -EFAULT;
++
++ if (count && buf[count - 1] == '\n')
++ buf[count - 1] = '\0';
++ else
++ buf[count] = '\0';
++
++ if (!strncmp(buf, "vow_sta_dwrr_quantum_id",
++ strlen("vow_sta_dwrr_quantum_id")))
++ {
++ rv = sscanf(buf, "vow_sta_dwrr_quantum_id=%d-%d-%d",
++ ¶m1, ¶m2, ¶m3);
++ if ((rv > 2) && (param2 < IEEE80211_NUM_ACS) &&
++ (param3 < VOW_WATF_LEVEL_NUM)) {
++ ret = mt7915_set_vow_sta_dwrr_quantum_id(dev, param1,
++ param2, param3);
++ }
++ else {
++ goto out;
++ }
++ }
++ else if (!strncmp(buf, "vow_atf_en", strlen("vow_atf_en")))
++ {
++ rv = sscanf(buf, "vow_atf_en=%d", ¶m1);
++ if (rv > 0) {
++ ret = mt7915_set_vow_atf_en(dev, param1);
++ }
++ else {
++ goto out;
++ }
++ }
++ else if (!strncmp(buf, "vow_dwrr_max_wait_time",
++ strlen("vow_dwrr_max_wait_time")))
++ {
++ rv = sscanf(buf, "vow_dwrr_max_wait_time=%d", ¶m1);
++ if (rv > 0) {
++ ret = mt7915_set_vow_dwrr_max_wait_time(dev, param1);
++ }
++ else {
++ goto out;
++ }
++ }
++ else if (!strncmp(buf, "vow_watf_en", strlen("vow_watf_en")))
++ {
++ rv = sscanf(buf, "vow_watf_en=%d", ¶m1);
++ if (rv > 0) {
++ ret = mt7915_set_vow_watf_en(dev, param1);
++ }
++ else {
++ goto out;
++ }
++ }
++ else if (!strncmp(buf, "vow_watf_quantum",
++ strlen("vow_watf_quantum")))
++ {
++ rv = sscanf(buf, "vow_watf_quantum=%d-%d",
++ ¶m1, ¶m2);
++ if ((dev->vow_cfg.vow_watf_en) && (rv > 1) &&
++ (param1 < VOW_WATF_LEVEL_NUM)) {
++ ret = mt7915_set_vow_watf_quantum(dev, param1, param2);
++ }
++ else {
++ goto out;
++ }
++ }
++ else if (!strncmp(buf, "vow_show_en", strlen("vow_show_en")))
++ {
++ rv = sscanf(buf, "vow_show_en=%d", ¶m1);
++ if (rv > 0) {
++ ret = mt7915_set_vow_show_en(dev, param1);
++ }
++ else {
++ goto out;
++ }
++ }
++ else if (!strncmp(buf, "vow_show_sta", strlen("vow_show_sta")))
++ {
++ rv = sscanf(buf, "vow_show_sta=%d", ¶m1);
++ if ((rv > 0)&& (param1 < MT7915_WTBL_STA)) {
++ ret = mt7915_set_vow_show_sta(dev, param1);
++ }
++ else {
++ goto out;
++ }
++ }
++ else if (!strncmp(buf, "show_vow_info", strlen("show_vow_info")))
++ {
++ if (rv == 0) {
++ ret = mt7915_set_show_vow_info(dev);
++ }
++ else {
++ dev_err(dev->mt76.dev, "show_vow_info\n");
++ goto out;
++ }
++ }
++ else if (!strncmp(buf, "show_vow_sta_conf", strlen("show_vow_sta_conf")))
++ {
++ rv = sscanf(buf, "show_vow_sta_conf=%d", ¶m1);
++ if ((rv > 0) && (param1 < MT7915_WTBL_STA)) {
++ ret = mt7915_show_vow_sta_conf(dev, param1);
++ }
++ else {
++ goto out;
++ }
++ }
++
++ if (ret)
++ return ret;
++out:
++ return count;
++}
++
++static const struct file_operations mt7915_vow_ops = {
++ .write = mt7915_vow_set,
++ .read = mt7915_vow_get,
++ .open = simple_open,
++ .llseek = default_llseek,
++};
++
+ static int
+ mt7915_radar_trigger(void *data, u64 val)
+ {
+@@ -1120,6 +1524,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+ debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
+ mt7915_twt_stats);
+ debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
++ debugfs_create_file("vow", 0600, dir, phy, &mt7915_vow_ops);
+
+ if (!dev->dbdc_support || phy->band_idx) {
+ debugfs_create_u32("dfs_hw_pattern", 0400, dir,
+diff --git a/mt7915/init.c b/mt7915/init.c
+old mode 100644
+new mode 100755
+index 8f32b6a8..f62a9dae
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -476,10 +476,46 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
+ mt76_rmw(dev, MT_WTBLOFF_TOP_RSCR(band), mask, set);
+ }
+
++void mt7915_vow_init(struct mt7915_dev *dev)
++{
++ struct mt7915_vow_cfg *vow_cfg = &dev->vow_cfg;
++ bool ret;
++ int i;
++
++ if (!(is_mt7915(&dev->mt76)))
++ vow_cfg->vow_feature |= VOW_FEATURE_BWCG;
++
++ vow_cfg->vow_atf_en = 0x1;
++ vow_cfg->sta_max_wait_time = 0x40;
++ vow_cfg->refill_period = 0x5;
++
++ vow_cfg->vow_sta_dwrr_quantum[0] = 0x06;
++ vow_cfg->vow_sta_dwrr_quantum[1] = 0x0c;
++ vow_cfg->vow_sta_dwrr_quantum[2] = 0x10;
++ vow_cfg->vow_sta_dwrr_quantum[3] = 0x14;
++ vow_cfg->vow_sta_dwrr_quantum[4] = 0x18;
++ vow_cfg->vow_sta_dwrr_quantum[5] = 0x1c;
++ vow_cfg->vow_sta_dwrr_quantum[6] = 0x20;
++ vow_cfg->vow_sta_dwrr_quantum[7] = 0x24;
++
++ ret = mt7915_mcu_set_vow_drr_ctrl(dev, NULL,
++ VOW_DRR_AIRTIME_DEFICIT_BOUND);
++ ret = mt7915_mcu_set_vow_drr_ctrl(dev, NULL,
++ VOW_DRR_AIRTIME_QUANTUM_ALL);
++
++ for(i = 0; i < 4; i++)
++ ret = mt7915_mcu_set_vow_drr_ctrl(dev, NULL,
++ VOW_DRR_AIRTIME_QUANTUM_L0 + i);
++
++ ret = mt7915_mcu_set_vow_feature_ctrl(dev);
++ return;
++}
++
+ void mt7915_mac_init(struct mt7915_dev *dev)
+ {
+ int i;
+ u32 rx_len = is_mt7915(&dev->mt76) ? 0x400 : 0x680;
++ struct wiphy *wiphy = dev->phy.mt76->hw->wiphy;
+
+ /* config pse qid6 wfdma port selection */
+ if (!is_mt7915(&dev->mt76) && dev->hif2)
+@@ -504,6 +540,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
+ i = dev->mt76.led_pin ? MT_LED_GPIO_MUX3 : MT_LED_GPIO_MUX2;
+ mt76_rmw_field(dev, i, MT_LED_GPIO_SEL_MASK, 4);
+ }
++
++ if (mt7915_is_atf_defult_on(wiphy, dev))
++ mt7915_vow_init(dev);
+ }
+
+ int mt7915_txbf_init(struct mt7915_dev *dev)
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 52aab3d1..ece28aa0 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -195,6 +195,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+ {
+ struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+ struct mt7915_dev *dev = mt7915_hw_dev(hw);
++ struct wiphy *wiphy = dev->phy.mt76->hw->wiphy;
+ struct mt7915_phy *phy = mt7915_hw_phy(hw);
+ struct mt76_txq *mtxq;
+ bool ext_phy = phy != &dev->phy;
+@@ -264,6 +265,10 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+ mt7915_mcu_add_sta(dev, vif, NULL, true);
+ rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
+
++ if (mt7915_is_atf_defult_on(wiphy, dev)) {
++ mt7915_mcu_set_vow_band(dev, mvif);
++ }
++
+ out:
+ mutex_unlock(&dev->mt76.mutex);
+
+@@ -683,6 +688,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
+ struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+ bool ext_phy = mvif->phy != &dev->phy;
++ struct wiphy *wiphy = dev->phy.mt76->hw->wiphy;
+ #ifdef CONFIG_MTK_VENDOR
+ struct mt7915_phy *phy;
+ #endif
+@@ -737,6 +743,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ mt7915_mcu_set_mimo(phy, 0);
+ }
+ #endif
++ if (mt7915_is_atf_defult_on(wiphy, dev)) {
++ msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VO] = 2;
++ msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VI] = 2;
++ msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BE] = 1;
++ msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BK] = 0;
++ mt7915_mcu_set_vow_drr_ctrl(dev, msta, VOW_DRR_STA_BSS_GROUP);
++ mt7915_mcu_set_vow_drr_ctrl(dev, msta, VOW_DRR_STA_PAUSE_SETTING);
++ mt7915_mcu_set_vow_drr_ctrl(dev, msta, VOW_DRR_STA_ALL);
++ }
++
+ return 0;
+ }
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index e6826c60..4d3def95 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -3428,6 +3428,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+ &req, sizeof(req), false);
+ }
+
++int mt7915_mcu_set_vow_drr_ctrl(struct mt7915_dev *dev,
++ struct mt7915_sta *msta,
++ u32 subcmd)
++{
++ u32 setting = 0;
++ u32 i;
++
++ struct {
++ __le32 action;
++ u8 wlan_idx_lo;
++ u8 status;
++ u8 wlan_idx_hi;
++ u8 rsv0[5];
++ union {
++ __le32 com_value;
++ struct {
++ u8 air_time_quantum[VOW_MAX_STA_DWRR_NUM];
++ }air_time_quantum_all;
++ }air_time_ctrl;
++ } __packed req = {
++ .action = cpu_to_le32(subcmd),
++ .wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : to_wcid_lo(0x0),
++ .wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : to_wcid_hi(0x0),
++ };
++
++ switch (subcmd) {
++ case VOW_DRR_STA_ALL:{
++ setting |= 0x00;
++ setting |= msta->vif->mt76.idx;
++ setting |= msta->vow_sta_cfg.ac_change_rule << 4;
++ setting |= (msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VO] << 8);
++ setting |= (msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VI] << 12);
++ setting |= (msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BE] << 16);
++ setting |= (msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BK] << 20);
++ if (dev->vow_cfg.vow_feature & VOW_FEATURE_BWCG)
++ setting |= ((UMAC_BWC_GROUP_MIN) << 24);
++ req.air_time_ctrl.com_value = cpu_to_le32(setting);
++ break;
++ }
++
++ case VOW_DRR_STA_BSS_GROUP:
++ req.air_time_ctrl.com_value = cpu_to_le32(0x0);
++ break;
++
++ case VOW_DRR_STA_PAUSE_SETTING:
++ req.air_time_ctrl.com_value = cpu_to_le32(msta->vow_sta_cfg.paused);
++ break;
++
++ case VOW_DRR_STA_AC0_QUA_ID:
++ req.air_time_ctrl.com_value =
++ cpu_to_le32(msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VO]);
++ break;
++
++ case VOW_DRR_STA_AC1_QUA_ID:
++ req.air_time_ctrl.com_value =
++ cpu_to_le32(msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VI]);
++ break;
++
++ case VOW_DRR_STA_AC2_QUA_ID:
++ req.air_time_ctrl.com_value =
++ cpu_to_le32(msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BE]);
++ break;
++
++ case VOW_DRR_STA_AC3_QUA_ID:
++ req.air_time_ctrl.com_value =
++ cpu_to_le32(msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BK]);
++ break;
++
++ case VOW_DRR_AIRTIME_DEFICIT_BOUND:
++ req.air_time_ctrl.com_value =
++ cpu_to_le32(dev->vow_cfg.sta_max_wait_time);
++ break;
++
++ case VOW_DRR_AIRTIME_QUANTUM_L0:
++ case VOW_DRR_AIRTIME_QUANTUM_L1:
++ case VOW_DRR_AIRTIME_QUANTUM_L2:
++ case VOW_DRR_AIRTIME_QUANTUM_L3:
++ case VOW_DRR_AIRTIME_QUANTUM_L4:
++ case VOW_DRR_AIRTIME_QUANTUM_L5:
++ case VOW_DRR_AIRTIME_QUANTUM_L6:
++ case VOW_DRR_AIRTIME_QUANTUM_L7:
++ req.air_time_ctrl.com_value =
++ cpu_to_le32(dev->vow_cfg.vow_sta_dwrr_quantum[subcmd -
++ VOW_DRR_AIRTIME_QUANTUM_L0]);
++ break;
++
++ case VOW_DRR_AIRTIME_QUANTUM_ALL: {
++ for (i = 0; i < VOW_MAX_STA_DWRR_NUM; i++) {
++ req.air_time_ctrl.air_time_quantum_all.air_time_quantum[i] =
++ dev->vow_cfg.vow_sta_dwrr_quantum[i];
++ }
++ break;
++ }
++
++ default:
++ break;
++ }
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL),
++ &req, sizeof(req), false);
++}
++
++int mt7915_mcu_set_vow_feature_ctrl(struct mt7915_dev *dev)
++{
++ u16 value = 0;
++ u32 sch_value = 0;
++
++ struct vow_feature_ctrl {
++ __le16 bss_flag;
++ __le16 vow_ctrl_flag;
++ __le16 bss_value[9];
++ __le16 vow_ctrl_val;
++ __le16 time_token_value[2];
++ __le16 length_token_value[2];
++ __le32 tx_ctrl;
++ __le32 sch_ctrl;
++ } __packed req = {
++ .bss_flag = cpu_to_le16(0xffff),
++ .vow_ctrl_flag = cpu_to_le16(0xf231),
++ .bss_value[0] = cpu_to_le16(0xffff),
++ .bss_value[2] = cpu_to_le16(0xffff),
++ .bss_value[8] = cpu_to_le16(0xffff),
++ .time_token_value[0] = cpu_to_le16(0xffff),
++ };
++
++ value |= dev->vow_cfg.refill_period;
++ value |= 1 << 4;
++ value |= 1 << 5;
++ value |= dev->vow_cfg.vow_watf_en << 9;
++ value |= 1 << 12;
++ value |= dev->vow_cfg.vow_atf_en << 13;
++ value |= 1 << 14;
++ req.vow_ctrl_val = value;
++ if (dev->vow_cfg.vow_atf_en)
++ req.tx_ctrl = cpu_to_le32(0x6bf69e1f);
++ sch_value |= 1 << 6;
++ sch_value |= (((dev->vow_cfg.vow_show_en == 0) ? 0 :
++ (dev->vow_cfg.vow_show_en - 1 )) << 4);
++ req.sch_ctrl = sch_value;
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_FEATURE_CTRL),
++ &req, sizeof(req), false);
++}
++
++int mt7915_mcu_set_vow_band(struct mt7915_dev *dev, struct mt7915_vif *mvif)
++{
++ struct module_ctrl {
++ __le16 action;
++ __le16 sub_action;
++ __le32 rsv1[5];
++ u8 rsv2[72];
++ u8 group_idx;
++ u8 band_idx;
++ u8 rsv3[2];
++ } __packed req = {
++ .action = cpu_to_le16(0x1),
++ .sub_action = cpu_to_le16(0x4),
++ .group_idx = mvif->mt76.band_idx * 4 + mvif->mt76.omac_idx % 4,
++ .band_idx = mvif->mt76.band_idx,
++ };
++
++ return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(AT_PROC_MODULE),
++ &req, sizeof(req), false);
++}
++
+ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+ {
+ struct {
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 3930c441..890e329e 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -132,6 +132,58 @@ struct mt7915_twt_flow {
+
+ DECLARE_EWMA(avg_signal, 10, 8)
+
++#define VOW_MAX_STA_DWRR_NUM 8
++#define VOW_WATF_LEVEL_NUM 4
++#define VOW_FEATURE_BWCG BIT(3)
++#define UMAC_BWC_GROUP_MIN 40
++
++
++enum ext_cmd_vow_drr_ctrl {
++ /* Type 1 */
++ VOW_DRR_STA_ALL = 0x00,
++ VOW_DRR_STA_BSS_GROUP = 0x01,
++ VOW_DRR_STA_AC0_QUA_ID = 0x03,
++ VOW_DRR_STA_AC1_QUA_ID = 0x04,
++ VOW_DRR_STA_AC2_QUA_ID = 0x05,
++ VOW_DRR_STA_AC3_QUA_ID = 0x06,
++
++ /* Type 2 */
++ VOW_DRR_AIRTIME_DEFICIT_BOUND = 0x10,
++
++ /* Type 3 */
++ VOW_DRR_AIRTIME_QUANTUM_L0 = 0x20,
++ VOW_DRR_AIRTIME_QUANTUM_L1 = 0x21,
++ VOW_DRR_AIRTIME_QUANTUM_L2 = 0x22,
++ VOW_DRR_AIRTIME_QUANTUM_L3 = 0x23,
++ VOW_DRR_AIRTIME_QUANTUM_L4 = 0x24,
++ VOW_DRR_AIRTIME_QUANTUM_L5 = 0x25,
++ VOW_DRR_AIRTIME_QUANTUM_L6 = 0x26,
++ VOW_DRR_AIRTIME_QUANTUM_L7 = 0x27,
++ VOW_DRR_AIRTIME_QUANTUM_ALL = 0x28,
++ VOW_DRR_STA_PAUSE_SETTING = 0x30,
++};
++
++struct mt7915_vow_sta_cfg{
++ u8 dwrr_quantum[IEEE80211_NUM_ACS];
++ u8 ac_change_rule;
++ bool paused;
++};
++
++struct mt7915_vow_cfg{
++ /*ATF setting */
++ u32 vow_feature;
++ bool vow_atf_en;
++ u8 refill_period;
++ u8 sta_max_wait_time;
++ u8 vow_sta_dwrr_quantum[VOW_MAX_STA_DWRR_NUM];
++ u8 vow_show_en;
++ u32 vow_show_sta;
++
++ /*WATF setting */
++ bool vow_watf_en;
++};
++
++
+ struct mt7915_sta {
+ struct mt76_wcid wcid; /* must be first */
+
+@@ -153,6 +205,7 @@ struct mt7915_sta {
+ u8 flowid_mask;
+ struct mt7915_twt_flow flow[MT7915_MAX_STA_TWT_AGRT];
+ } twt;
++ struct mt7915_vow_sta_cfg vow_sta_cfg;
+ };
+
+ struct mt7915_vif_cap {
+@@ -468,6 +521,8 @@ struct mt7915_dev {
+ } dbg;
+ const struct mt7915_dbg_reg_desc *dbg_reg;
+ #endif
++ struct delayed_work vow_work;
++ struct mt7915_vow_cfg vow_cfg;
+ };
+
+ enum {
+@@ -500,6 +555,15 @@ enum mt7915_rdd_cmd {
+ RDD_IRQ_OFF,
+ };
+
++static inline bool
++mt7915_is_atf_defult_on(struct wiphy *wiphy, struct mt7915_dev *dev)
++{
++ return ((!wiphy_ext_feature_isset(wiphy,
++ NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) ||
++ mtk_wed_device_active(&dev->mt76.mmio.wed));
++}
++
++
+ static inline struct mt7915_phy *
+ mt7915_hw_phy(struct ieee80211_hw *hw)
+ {
+@@ -627,6 +691,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+ u8 en);
+ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
++int mt7915_mcu_set_vow_drr_ctrl(struct mt7915_dev *dev, struct mt7915_sta *msta,
++ u32 subcmd);
++int mt7915_mcu_set_vow_feature_ctrl(struct mt7915_dev *dev);
++int mt7915_mcu_set_vow_band(struct mt7915_dev *dev, struct mt7915_vif *mvif);
+ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
+ int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
+ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index 61996085..f74b91fa 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -1301,7 +1301,6 @@ static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
+ };
+
+
+-
+ static char* sta_ctrl_reg[] = {"ENABLE", "DISABLE", "PAUSE"};
+ static u32 chip_show_sta_acq_info(struct seq_file *s, struct mt7915_dev *dev, u32 *ple_stat,
+ u32 *sta_pause, u32 *dis_sta_map,
+@@ -1455,6 +1454,138 @@ static void chip_get_sta_pause(struct mt7915_dev *dev, u32 *sta_pause)
+ }
+ }
+
++u32 vow_chip_show_sta_acq_info(struct mt7915_dev *dev, u32 *ple_stat,
++ u32 *sta_pause, u32 *dis_sta_map,
++ u32 dumptxd)
++{
++ int i, j;
++ u32 total_nonempty_cnt = 0;
++ u32 ac_num = 9, all_ac_num;
++ static char* sta_ctrl_reg[] = {"ENABLE", "DISABLE", "PAUSE"};
++ if (!is_mt7915(&dev->mt76))
++ ac_num = 17;
++
++ all_ac_num = ac_num * 4;
++
++ for (j = 0; j < all_ac_num; j++) { /* show AC Q info */
++ for (i = 0; i < 32; i++) {
++ if (((ple_stat[j + 1] & (0x1 << i)) >> i) == 0) {
++ u32 hfid, tfid, pktcnt, ac_n = j / ac_num, ctrl = 0;
++ u32 sta_num = i + (j % ac_num) * 32, fl_que_ctrl[3] = {0};
++ u32 wmmidx = 0;
++ struct mt7915_sta *msta;
++ struct mt76_wcid *wcid;
++ struct ieee80211_sta *sta = NULL;
++
++ wcid = rcu_dereference(dev->mt76.wcid[sta_num]);
++ sta = wcid_to_sta(wcid);
++ if (!sta) {
++ printk("ERROR!! no found STA wcid=%d\n", sta_num);
++ continue;
++ }
++ msta = container_of(wcid, struct mt7915_sta, wcid);
++ wmmidx = msta->vif->mt76.wmm_idx;
++
++ dev_info(dev->mt76.dev, "\tSTA%d AC%d: ", sta_num, ac_n);
++
++ fl_que_ctrl[0] |= MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK;
++ fl_que_ctrl[0] |= (ENUM_UMAC_LMAC_PORT_2 <<
++ MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT);
++ fl_que_ctrl[0] |= (ac_n << MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
++ fl_que_ctrl[0] |= sta_num;
++ mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL0, fl_que_ctrl[0]);
++ fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL2);
++ fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL3);
++ hfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK,
++ fl_que_ctrl[1]);
++ tfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK,
++ fl_que_ctrl[1]);
++ pktcnt = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK,
++ fl_que_ctrl[2]);
++ dev_info(dev->mt76.dev, "tail/head fid = 0x%03x/0x%03x, pkt cnt = 0x%03x",
++ tfid, hfid, pktcnt);
++
++ if (((sta_pause[j % 6] & 0x1 << i) >> i) == 1)
++ ctrl = 2;
++
++ if (((dis_sta_map[j % 6] & 0x1 << i) >> i) == 1)
++ ctrl = 1;
++
++ dev_info(dev->mt76.dev, " ctrl = %s", sta_ctrl_reg[ctrl]);
++ dev_info(dev->mt76.dev, " (wmmidx=%d)\n", wmmidx);
++
++ total_nonempty_cnt++;
++ }
++ }
++ }
++
++ return total_nonempty_cnt;
++}
++
++int mt7915_vow_pleinfo_read(struct mt7915_dev *dev)
++{
++ u32 ple_stat[70] = {0}, pg_flow_ctrl[8] = {0};
++ u32 ple_txcmd_stat;
++ u32 sta_pause[CR_NUM_OF_AC] = {0}, dis_sta_map[CR_NUM_OF_AC] = {0};
++ int i;
++
++ chip_get_ple_acq_stat(dev, ple_stat);
++ ple_txcmd_stat = mt76_rr(dev, MT_DBG_PLE_TXCMD_Q_EMPTY);
++ pg_flow_ctrl[0] = mt76_rr(dev, MT_DBG_PLE_FREEPG_CNT);
++ pg_flow_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FREEPG_HEAD_TAIL);
++ pg_flow_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_PG_HIF_GROUP);
++ pg_flow_ctrl[3] = mt76_rr(dev, MT_DBG_PLE_HIF_PG_INFO);
++ pg_flow_ctrl[4] = mt76_rr(dev, MT_DBG_PLE_PG_CPU_GROUP);
++ pg_flow_ctrl[5] = mt76_rr(dev, MT_DBG_PLE_CPU_PG_INFO);
++ pg_flow_ctrl[6] = mt76_rr(dev, MT_DBG_PLE_PG_HIF_TXCMD_GROUP);
++ pg_flow_ctrl[7] = mt76_rr(dev, MT_DBG_PLE_HIF_TXCMD_PG_INFO);
++ chip_get_dis_sta_map(dev, dis_sta_map);
++ chip_get_sta_pause(dev, sta_pause);
++
++ dev_info(dev->mt76.dev, "PLE Configuration Info:\n");
++
++ for (i = 0; i < 32; i++) {
++ if (((ple_stat[0] & (0x1 << i)) >> i) == 0) {
++ u32 hfid, tfid, pktcnt, fl_que_ctrl[3] = {0};
++
++ if (ple_queue_empty_info[i].QueueName != NULL) {
++ fl_que_ctrl[0] |= MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK;
++ fl_que_ctrl[0] |= (ple_queue_empty_info[i].Portid <<
++ MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT);
++ fl_que_ctrl[0] |= (ple_queue_empty_info[i].Queueid <<
++ MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
++ } else
++ continue;
++
++ if (ple_queue_empty_info[i].Queueid >=
++ ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_0 &&
++ ple_queue_empty_info[i].Queueid <=
++ ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_0)
++ /* band0 set TGID 0, bit31 = 0 */
++ mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL1, 0x0);
++ else if (ple_queue_empty_info[i].Queueid >=
++ ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_1 &&
++ ple_queue_empty_info[i].Queueid <=
++ ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_1)
++ /* band1 set TGID 1, bit31 = 1 */
++ mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL1, 0x80000000);
++
++ mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL0, fl_que_ctrl[0]);
++ fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL2);
++ fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL3);
++ hfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK,
++ fl_que_ctrl[1]);
++ tfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK,
++ fl_que_ctrl[1]);
++ pktcnt = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK,
++ fl_que_ctrl[2]);
++ }
++ }
++
++ vow_chip_show_sta_acq_info(dev, ple_stat, sta_pause, dis_sta_map, 0);
++
++ return 0;
++}
+ static int mt7915_pleinfo_read(struct seq_file *s, void *data)
+ {
+ struct mt7915_dev *dev = dev_get_drvdata(s->private);
+--
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
new file mode 100644
index 0000000..6866209
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
@@ -0,0 +1,42 @@
+#patch patches (come from openwrt/lede/target/linux/mediatek)
+SRC_URI_append = " \
+ file://0000-mt76-sync-to-master-lastest-commit.patch \
+ file://100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch \
+ file://1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch \
+ file://1002-mt76-mt7915-csi-implement-csi-support.patch \
+ file://1003-mt76-mt7915-air-monitor-support.patch \
+ file://1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch \
+ file://1005-mt76-mt7915-certification-patches.patch \
+ file://1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch \
+ file://1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch \
+ file://1008-mt76-mt7915-drop-undefined-action-frame.patch \
+ file://1009-mt76-mt7915-add-fw_version-dump.patch \
+ file://1111-mt76-mt7915-rework-testmode-init-registers.patch \
+ file://1112-mt76-testmode-additional-supports.patch \
+ file://1113-mt76-testmode-add-pre-cal-support.patch \
+ file://1114-mt76-testmode-add-iBF-command-mode-support.patch \
+ file://1115-mt76-testmode-add-ZWDFS-test-mode-support.patch \
+ file://1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
+ file://1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch \
+ file://1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch \
+ file://1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
+ file://1120-mt76-mt7915-add-phy-capability-vendor-command.patch \
+ file://1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch \
+ file://1122-mt76-mt7915-implement-bin-file-mode.patch \
+ file://1123-mt76-mt7915-initialize-wcid.patch \
+ file://1124-mt76-mt7915-Add-hemu-dump-support.patch \
+ file://1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
+ file://1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch \
+ file://1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch \
+ file://1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch \
+ file://3001-mt76-mt7915-wed-add-wed-tx-support.patch \
+ file://3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch \
+ file://3003-mt76-connac-wed-add-wed-rx-copy-skb.patch \
+ file://3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch \
+ file://3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch \
+ file://3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch \
+ file://3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch \
+ file://3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch \
+ file://3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch \
+ file://3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch \
+ "
diff --git a/recipes-wifi/linux-mt76/linux-mt76.bb b/recipes-wifi/linux-mt76/linux-mt76_2.x.bb
similarity index 99%
rename from recipes-wifi/linux-mt76/linux-mt76.bb
rename to recipes-wifi/linux-mt76/linux-mt76_2.x.bb
index 81b4c62..970937d 100644
--- a/recipes-wifi/linux-mt76/linux-mt76.bb
+++ b/recipes-wifi/linux-mt76/linux-mt76_2.x.bb
@@ -5,8 +5,6 @@
inherit module
-PV = "1.0"
-
require mt76.inc
SRC_URI = " \
git://git@github.com/openwrt/mt76.git;protocol=https \
diff --git a/recipes-wifi/linux-mt76/linux-mt76.bb b/recipes-wifi/linux-mt76/linux-mt76_3.x.bb
similarity index 97%
copy from recipes-wifi/linux-mt76/linux-mt76.bb
copy to recipes-wifi/linux-mt76/linux-mt76_3.x.bb
index 81b4c62..88c2358 100644
--- a/recipes-wifi/linux-mt76/linux-mt76.bb
+++ b/recipes-wifi/linux-mt76/linux-mt76_3.x.bb
@@ -5,9 +5,7 @@
inherit module
-PV = "1.0"
-
-require mt76.inc
+require mt76_${PV}.inc
SRC_URI = " \
git://git@github.com/openwrt/mt76.git;protocol=https \
file://COPYING;subdir=git \
@@ -22,10 +20,9 @@
DEPENDS += "virtual/kernel"
DEPENDS += "linux-mac80211"
-FILESEXTRAPATHS_prepend := "${THISDIR}/files/patches:"
+FILESEXTRAPATHS_prepend := "${THISDIR}/files/patches-${PV}:"
FILESEXTRAPATHS_prepend := "${THISDIR}/src:"
-#require files/patches/patches.inc
SRC_URI += "file://*.patch;apply=no"
S = "${WORKDIR}/git"
diff --git a/recipes-wifi/linux-mt76/mt76_3.x.inc b/recipes-wifi/linux-mt76/mt76_3.x.inc
new file mode 100644
index 0000000..598d8af
--- /dev/null
+++ b/recipes-wifi/linux-mt76/mt76_3.x.inc
@@ -0,0 +1 @@
+SRCREV ?= "4bf2607362fc64fc4cb7d662feb736b7536c0811"
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/001-wolfssl-init-RNG-with-ECC-key.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/001-wolfssl-init-RNG-with-ECC-key.patch
new file mode 100644
index 0000000..269dcaa
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/001-wolfssl-init-RNG-with-ECC-key.patch
@@ -0,0 +1,43 @@
+From 21ce83b4ae2b9563175fdb4fc4312096cc399cf8 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Wed, 5 May 2021 00:44:34 +0200
+Subject: [PATCH] wolfssl: add RNG to EC key
+
+Since upstream commit 6467de5a8840 ("Randomize z ordinates in
+scalar mult when timing resistant") WolfSSL requires a RNG for
+the EC key when built hardened which is the default.
+
+Set the RNG for the EC key to fix connections for OWE clients.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ src/crypto/crypto_wolfssl.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/src/crypto/crypto_wolfssl.c
++++ b/src/crypto/crypto_wolfssl.c
+@@ -1340,6 +1340,7 @@ int ecc_projective_add_point(ecc_point *
+
+ struct crypto_ec {
+ ecc_key key;
++ WC_RNG rng;
+ mp_int a;
+ mp_int prime;
+ mp_int order;
+@@ -1394,6 +1395,8 @@ struct crypto_ec * crypto_ec_init(int gr
+ return NULL;
+
+ if (wc_ecc_init(&e->key) != 0 ||
++ wc_InitRng(&e->rng) != 0 ||
++ wc_ecc_set_rng(&e->key, &e->rng) != 0 ||
+ wc_ecc_set_curve(&e->key, 0, curve_id) != 0 ||
+ mp_init(&e->a) != MP_OKAY ||
+ mp_init(&e->prime) != MP_OKAY ||
+@@ -1425,6 +1428,7 @@ void crypto_ec_deinit(struct crypto_ec*
+ mp_clear(&e->order);
+ mp_clear(&e->prime);
+ mp_clear(&e->a);
++ wc_FreeRng(&e->rng);
+ wc_ecc_free(&e->key);
+ os_free(e);
+ }
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
new file mode 100644
index 0000000..6bc48ab
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
@@ -0,0 +1,106 @@
+From 8de8cd8380af0c43d4fde67a668d79ef73b26b26 Mon Sep 17 00:00:00 2001
+From: Peter Oh <peter.oh@bowerswilkins.com>
+Date: Tue, 30 Jun 2020 14:18:58 +0200
+Subject: [PATCH 10/19] mesh: Allow DFS channels to be selected if dfs is
+ enabled
+
+Note: DFS is assumed to be usable if a country code has been set
+
+Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
+Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
+---
+ wpa_supplicant/wpa_supplicant.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -2436,7 +2436,7 @@ static int drv_supports_vht(struct wpa_s
+ }
+
+
+-static bool ibss_mesh_is_80mhz_avail(int channel, struct hostapd_hw_modes *mode)
++static bool ibss_mesh_is_80mhz_avail(int channel, struct hostapd_hw_modes *mode, bool dfs_enabled)
+ {
+ int i;
+
+@@ -2445,7 +2445,10 @@ static bool ibss_mesh_is_80mhz_avail(int
+
+ chan = hw_get_channel_chan(mode, i, NULL);
+ if (!chan ||
+- chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
++ chan->flag & HOSTAPD_CHAN_DISABLED)
++ return false;
++
++ if (!dfs_enabled && chan->flag & (HOSTAPD_CHAN_RADAR | HOSTAPD_CHAN_NO_IR))
+ return false;
+ }
+
+@@ -2474,6 +2477,8 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ int chwidth, seg0, seg1;
+ u32 vht_caps = 0;
+ bool is_24ghz, is_6ghz;
++ bool dfs_enabled = wpa_s->conf->country[0] &&
++ (wpa_s->drv_flags & WPA_DRIVER_FLAGS_RADAR);
+
+ freq->freq = ssid->frequency;
+
+@@ -2570,8 +2575,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ return;
+
+ /* Check primary channel flags */
+- if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
++ if (pri_chan->flag & HOSTAPD_CHAN_DISABLED)
+ return;
++ if (pri_chan->flag & (HOSTAPD_CHAN_RADAR | HOSTAPD_CHAN_NO_IR))
++ if (!dfs_enabled)
++ return;
+
+ freq->channel = pri_chan->chan;
+
+@@ -2604,8 +2612,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ return;
+
+ /* Check secondary channel flags */
+- if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
++ if (sec_chan->flag & HOSTAPD_CHAN_DISABLED)
+ return;
++ if (sec_chan->flag & (HOSTAPD_CHAN_RADAR | HOSTAPD_CHAN_NO_IR))
++ if (!dfs_enabled)
++ return;
+
+ if (ht40 == -1) {
+ if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
+@@ -2694,7 +2705,7 @@ skip_to_6ghz:
+ return;
+
+ /* Back to HT configuration if channel not usable */
+- if (!ibss_mesh_is_80mhz_avail(channel, mode))
++ if (!ibss_mesh_is_80mhz_avail(channel, mode, dfs_enabled))
+ return;
+
+ chwidth = CONF_OPER_CHWIDTH_80MHZ;
+@@ -2708,7 +2719,7 @@ skip_to_6ghz:
+ * above; check the remaining four 20 MHz channels for the total
+ * of 160 MHz bandwidth.
+ */
+- if (!ibss_mesh_is_80mhz_avail(channel + 16, mode))
++ if (!ibss_mesh_is_80mhz_avail(channel + 16, mode, dfs_enabled))
+ return;
+
+ for (j = 0; j < ARRAY_SIZE(bw160); j++) {
+@@ -2738,10 +2749,12 @@ skip_to_6ghz:
+ if (!chan)
+ continue;
+
+- if (chan->flag & (HOSTAPD_CHAN_DISABLED |
+- HOSTAPD_CHAN_NO_IR |
+- HOSTAPD_CHAN_RADAR))
++ if (chan->flag & HOSTAPD_CHAN_DISABLED)
+ continue;
++ if (chan->flag & (HOSTAPD_CHAN_RADAR |
++ HOSTAPD_CHAN_NO_IR))
++ if (!dfs_enabled)
++ continue;
+
+ /* Found a suitable second segment for 80+80 */
+ chwidth = CONF_OPER_CHWIDTH_80P80MHZ;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/011-mesh-use-deterministic-channel-on-channel-switch.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/011-mesh-use-deterministic-channel-on-channel-switch.patch
new file mode 100644
index 0000000..32a4479
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/011-mesh-use-deterministic-channel-on-channel-switch.patch
@@ -0,0 +1,81 @@
+From fc8ea40f6130ac18d9c66797de2cf1d5af55d496 Mon Sep 17 00:00:00 2001
+From: Markus Theil <markus.theil@tu-ilmenau.de>
+Date: Tue, 30 Jun 2020 14:19:07 +0200
+Subject: [PATCH 19/19] mesh: use deterministic channel on channel switch
+
+This patch uses a deterministic channel on DFS channel switch
+in mesh networks. Otherwise, when switching to a usable but not
+available channel, no CSA can be sent and a random channel is choosen
+without notification of other nodes. It is then quite likely, that
+the mesh network gets disconnected.
+
+Fix this by using a deterministic number, based on the sha256 hash
+of the mesh ID, in order to use at least a different number in each
+mesh network.
+
+Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
+---
+ src/ap/dfs.c | 20 +++++++++++++++++++-
+ src/drivers/driver_nl80211.c | 4 ++++
+ 2 files changed, 23 insertions(+), 1 deletion(-)
+
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -17,6 +17,7 @@
+ #include "ap_drv_ops.h"
+ #include "drivers/driver.h"
+ #include "dfs.h"
++#include "crypto/crypto.h"
+
+
+ enum dfs_channel_type {
+@@ -515,9 +516,14 @@ dfs_get_valid_channel(struct hostapd_ifa
+ int num_available_chandefs;
+ int chan_idx, chan_idx2;
+ int sec_chan_idx_80p80 = -1;
++ bool is_mesh = false;
+ int i;
+ u32 _rand;
+
++#ifdef CONFIG_MESH
++ is_mesh = iface->mconf;
++#endif
++
+ wpa_printf(MSG_DEBUG, "DFS: Selecting random channel");
+ *secondary_channel = 0;
+ *oper_centr_freq_seg0_idx = 0;
+@@ -537,8 +543,20 @@ dfs_get_valid_channel(struct hostapd_ifa
+ if (num_available_chandefs == 0)
+ return NULL;
+
+- if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
++ /* try to use deterministic channel in mesh, so that both sides
++ * have a chance to switch to the same channel */
++ if (is_mesh) {
++#ifdef CONFIG_MESH
++ u64 hash[4];
++ const u8 *meshid[1] = { &iface->mconf->meshid[0] };
++ const size_t meshid_len = iface->mconf->meshid_len;
++
++ sha256_vector(1, meshid, &meshid_len, (u8 *)&hash[0]);
++ _rand = hash[0] + hash[1] + hash[2] + hash[3];
++#endif
++ } else if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
+ return NULL;
++
+ chan_idx = _rand % num_available_chandefs;
+ dfs_find_channel(iface, &chan, chan_idx, type);
+ if (!chan) {
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -9948,6 +9948,10 @@ static int nl80211_switch_channel(void *
+ if (ret)
+ goto error;
+
++ if (drv->nlmode == NL80211_IFTYPE_MESH_POINT) {
++ nla_put_flag(msg, NL80211_ATTR_HANDLE_DFS);
++ }
++
+ /* beacon_csa params */
+ beacon_csa = nla_nest_start(msg, NL80211_ATTR_CSA_IES);
+ if (!beacon_csa)
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/021-fix-sta-add-after-previous-connection.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/021-fix-sta-add-after-previous-connection.patch
new file mode 100644
index 0000000..80b23bd
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/021-fix-sta-add-after-previous-connection.patch
@@ -0,0 +1,26 @@
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -4963,6 +4963,13 @@ static int add_associated_sta(struct hos
+ * drivers to accept the STA parameter configuration. Since this is
+ * after a new FT-over-DS exchange, a new TK has been derived, so key
+ * reinstallation is not a concern for this case.
++ *
++ * If the STA was associated and authorized earlier, but came for a new
++ * connection (!added_unassoc + !reassoc), remove the existing STA entry
++ * so that it can be re-added. This case is rarely seen when the AP could
++ * not receive the deauth/disassoc frame from the STA. And the STA comes
++ * back with new connection within a short period or before the inactive
++ * STA entry is removed from the list.
+ */
+ wpa_printf(MSG_DEBUG, "Add associated STA " MACSTR
+ " (added_unassoc=%d auth_alg=%u ft_over_ds=%u reassoc=%d authorized=%d ft_tk=%d fils_tk=%d)",
+@@ -4976,7 +4983,8 @@ static int add_associated_sta(struct hos
+ (!(sta->flags & WLAN_STA_AUTHORIZED) ||
+ (reassoc && sta->ft_over_ds && sta->auth_alg == WLAN_AUTH_FT) ||
+ (!wpa_auth_sta_ft_tk_already_set(sta->wpa_sm) &&
+- !wpa_auth_sta_fils_tk_already_set(sta->wpa_sm)))) {
++ !wpa_auth_sta_fils_tk_already_set(sta->wpa_sm)) ||
++ (!reassoc && (sta->flags & WLAN_STA_AUTHORIZED)))) {
+ hostapd_drv_sta_remove(hapd, sta->addr);
+ wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED);
+ set = 0;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/022-hostapd-fix-use-of-uninitialized-stack-variables.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/022-hostapd-fix-use-of-uninitialized-stack-variables.patch
new file mode 100644
index 0000000..25801da
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/022-hostapd-fix-use-of-uninitialized-stack-variables.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 8 Jul 2021 16:33:03 +0200
+Subject: [PATCH] hostapd: fix use of uninitialized stack variables
+
+When a CSA is performed on an 80 MHz channel, hostapd_change_config_freq
+unconditionally calls hostapd_set_oper_centr_freq_seg0/1_idx with seg0/1
+filled by ieee80211_freq_to_chan.
+However, if ieee80211_freq_to_chan fails (because the freq is 0 or invalid),
+seg0/1 remains uninitialized and filled with stack garbage, causing errors
+such as "hostapd: 80 MHz: center segment 1 configured"
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -3453,7 +3453,7 @@ static int hostapd_change_config_freq(st
+ struct hostapd_freq_params *old_params)
+ {
+ int channel;
+- u8 seg0, seg1;
++ u8 seg0 = 0, seg1 = 0;
+ struct hostapd_hw_modes *mode;
+
+ if (!params->channel) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/023-ndisc_snoop-call-dl_list_del-before-freeing-ipv6-add.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/023-ndisc_snoop-call-dl_list_del-before-freeing-ipv6-add.patch
new file mode 100644
index 0000000..9ff9b23
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/023-ndisc_snoop-call-dl_list_del-before-freeing-ipv6-add.patch
@@ -0,0 +1,19 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 28 Jul 2021 05:43:29 +0200
+Subject: [PATCH] ndisc_snoop: call dl_list_del before freeing ipv6 addresses
+
+Fixes a segmentation fault on sta disconnect
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/ap/ndisc_snoop.c
++++ b/src/ap/ndisc_snoop.c
+@@ -61,6 +61,7 @@ void sta_ip6addr_del(struct hostapd_data
+ dl_list_for_each_safe(ip6addr, prev, &sta->ip6addr, struct ip6addr,
+ list) {
+ hostapd_drv_br_delete_ip_neigh(hapd, 6, (u8 *) &ip6addr->addr);
++ dl_list_del(&ip6addr->list);
+ os_free(ip6addr);
+ }
+ }
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
new file mode 100644
index 0000000..988fbbc
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
@@ -0,0 +1,275 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 28 Jul 2021 05:49:46 +0200
+Subject: [PATCH] driver_nl80211: rewrite neigh code to not depend on
+ libnl3-route
+
+Removes an unnecessary dependency and also makes the code smaller
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -16,9 +16,6 @@
+ #include <net/if.h>
+ #include <netlink/genl/genl.h>
+ #include <netlink/genl/ctrl.h>
+-#ifdef CONFIG_LIBNL3_ROUTE
+-#include <netlink/route/neighbour.h>
+-#endif /* CONFIG_LIBNL3_ROUTE */
+ #include <linux/rtnetlink.h>
+ #include <netpacket/packet.h>
+ #include <linux/errqueue.h>
+@@ -5344,26 +5341,29 @@ fail:
+
+ static void rtnl_neigh_delete_fdb_entry(struct i802_bss *bss, const u8 *addr)
+ {
+-#ifdef CONFIG_LIBNL3_ROUTE
+ struct wpa_driver_nl80211_data *drv = bss->drv;
+- struct rtnl_neigh *rn;
+- struct nl_addr *nl_addr;
++ struct ndmsg nhdr = {
++ .ndm_state = NUD_PERMANENT,
++ .ndm_ifindex = bss->ifindex,
++ .ndm_family = AF_BRIDGE,
++ };
++ struct nl_msg *msg;
+ int err;
+
+- rn = rtnl_neigh_alloc();
+- if (!rn)
++ msg = nlmsg_alloc_simple(RTM_DELNEIGH, NLM_F_CREATE);
++ if (!msg)
+ return;
+
+- rtnl_neigh_set_family(rn, AF_BRIDGE);
+- rtnl_neigh_set_ifindex(rn, bss->ifindex);
+- nl_addr = nl_addr_build(AF_BRIDGE, (void *) addr, ETH_ALEN);
+- if (!nl_addr) {
+- rtnl_neigh_put(rn);
+- return;
+- }
+- rtnl_neigh_set_lladdr(rn, nl_addr);
++ if (nlmsg_append(msg, &nhdr, sizeof(nhdr), NLMSG_ALIGNTO) < 0)
++ goto errout;
++
++ if (nla_put(msg, NDA_LLADDR, ETH_ALEN, (void *)addr))
++ goto errout;
++
++ if (nl_send_auto_complete(drv->rtnl_sk, msg) < 0)
++ goto errout;
+
+- err = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
++ err = nl_wait_for_ack(drv->rtnl_sk);
+ if (err < 0) {
+ wpa_printf(MSG_DEBUG, "nl80211: bridge FDB entry delete for "
+ MACSTR " ifindex=%d failed: %s", MAC2STR(addr),
+@@ -5373,9 +5373,8 @@ static void rtnl_neigh_delete_fdb_entry(
+ MACSTR, MAC2STR(addr));
+ }
+
+- nl_addr_put(nl_addr);
+- rtnl_neigh_put(rn);
+-#endif /* CONFIG_LIBNL3_ROUTE */
++errout:
++ nlmsg_free(msg);
+ }
+
+
+@@ -7763,7 +7762,6 @@ static void *i802_init(struct hostapd_da
+ (params->num_bridge == 0 || !params->bridge[0]))
+ add_ifidx(drv, br_ifindex, drv->ifindex);
+
+-#ifdef CONFIG_LIBNL3_ROUTE
+ if (bss->added_if_into_bridge || bss->already_in_bridge) {
+ int err;
+
+@@ -7780,7 +7778,6 @@ static void *i802_init(struct hostapd_da
+ goto failed;
+ }
+ }
+-#endif /* CONFIG_LIBNL3_ROUTE */
+
+ if (drv->capa.flags2 & WPA_DRIVER_FLAGS2_CONTROL_PORT_RX) {
+ wpa_printf(MSG_DEBUG,
+@@ -10813,13 +10810,14 @@ static int wpa_driver_br_add_ip_neigh(vo
+ const u8 *ipaddr, int prefixlen,
+ const u8 *addr)
+ {
+-#ifdef CONFIG_LIBNL3_ROUTE
+ struct i802_bss *bss = priv;
+ struct wpa_driver_nl80211_data *drv = bss->drv;
+- struct rtnl_neigh *rn;
+- struct nl_addr *nl_ipaddr = NULL;
+- struct nl_addr *nl_lladdr = NULL;
+- int family, addrsize;
++ struct ndmsg nhdr = {
++ .ndm_state = NUD_PERMANENT,
++ .ndm_ifindex = bss->br_ifindex,
++ };
++ struct nl_msg *msg;
++ int addrsize;
+ int res;
+
+ if (!ipaddr || prefixlen == 0 || !addr)
+@@ -10838,85 +10836,66 @@ static int wpa_driver_br_add_ip_neigh(vo
+ }
+
+ if (version == 4) {
+- family = AF_INET;
++ nhdr.ndm_family = AF_INET;
+ addrsize = 4;
+ } else if (version == 6) {
+- family = AF_INET6;
++ nhdr.ndm_family = AF_INET6;
+ addrsize = 16;
+ } else {
+ return -EINVAL;
+ }
+
+- rn = rtnl_neigh_alloc();
+- if (rn == NULL)
++ msg = nlmsg_alloc_simple(RTM_NEWNEIGH, NLM_F_CREATE);
++ if (!msg)
+ return -ENOMEM;
+
+- /* set the destination ip address for neigh */
+- nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
+- if (nl_ipaddr == NULL) {
+- wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
+- res = -ENOMEM;
++ res = -ENOMEM;
++ if (nlmsg_append(msg, &nhdr, sizeof(nhdr), NLMSG_ALIGNTO) < 0)
+ goto errout;
+- }
+- nl_addr_set_prefixlen(nl_ipaddr, prefixlen);
+- res = rtnl_neigh_set_dst(rn, nl_ipaddr);
+- if (res) {
+- wpa_printf(MSG_DEBUG,
+- "nl80211: neigh set destination addr failed");
++
++ if (nla_put(msg, NDA_DST, addrsize, (void *)ipaddr))
+ goto errout;
+- }
+
+- /* set the corresponding lladdr for neigh */
+- nl_lladdr = nl_addr_build(AF_BRIDGE, (u8 *) addr, ETH_ALEN);
+- if (nl_lladdr == NULL) {
+- wpa_printf(MSG_DEBUG, "nl80211: neigh set lladdr failed");
+- res = -ENOMEM;
++ if (nla_put(msg, NDA_LLADDR, ETH_ALEN, (void *)addr))
+ goto errout;
+- }
+- rtnl_neigh_set_lladdr(rn, nl_lladdr);
+
+- rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
+- rtnl_neigh_set_state(rn, NUD_PERMANENT);
++ res = nl_send_auto_complete(drv->rtnl_sk, msg);
++ if (res < 0)
++ goto errout;
+
+- res = rtnl_neigh_add(drv->rtnl_sk, rn, NLM_F_CREATE);
++ res = nl_wait_for_ack(drv->rtnl_sk);
+ if (res) {
+ wpa_printf(MSG_DEBUG,
+ "nl80211: Adding bridge ip neigh failed: %s",
+ nl_geterror(res));
+ }
+ errout:
+- if (nl_lladdr)
+- nl_addr_put(nl_lladdr);
+- if (nl_ipaddr)
+- nl_addr_put(nl_ipaddr);
+- if (rn)
+- rtnl_neigh_put(rn);
++ nlmsg_free(msg);
+ return res;
+-#else /* CONFIG_LIBNL3_ROUTE */
+- return -1;
+-#endif /* CONFIG_LIBNL3_ROUTE */
+ }
+
+
+ static int wpa_driver_br_delete_ip_neigh(void *priv, u8 version,
+ const u8 *ipaddr)
+ {
+-#ifdef CONFIG_LIBNL3_ROUTE
+ struct i802_bss *bss = priv;
+ struct wpa_driver_nl80211_data *drv = bss->drv;
+- struct rtnl_neigh *rn;
+- struct nl_addr *nl_ipaddr;
+- int family, addrsize;
++ struct ndmsg nhdr = {
++ .ndm_state = NUD_PERMANENT,
++ .ndm_ifindex = bss->br_ifindex,
++ };
++ struct nl_msg *msg;
++ int addrsize;
+ int res;
+
+ if (!ipaddr)
+ return -EINVAL;
+
+ if (version == 4) {
+- family = AF_INET;
++ nhdr.ndm_family = AF_INET;
+ addrsize = 4;
+ } else if (version == 6) {
+- family = AF_INET6;
++ nhdr.ndm_family = AF_INET6;
+ addrsize = 16;
+ } else {
+ return -EINVAL;
+@@ -10934,41 +10913,30 @@ static int wpa_driver_br_delete_ip_neigh
+ return -1;
+ }
+
+- rn = rtnl_neigh_alloc();
+- if (rn == NULL)
++ msg = nlmsg_alloc_simple(RTM_DELNEIGH, NLM_F_CREATE);
++ if (!msg)
+ return -ENOMEM;
+
+- /* set the destination ip address for neigh */
+- nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
+- if (nl_ipaddr == NULL) {
+- wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
+- res = -ENOMEM;
++ res = -ENOMEM;
++ if (nlmsg_append(msg, &nhdr, sizeof(nhdr), NLMSG_ALIGNTO) < 0)
+ goto errout;
+- }
+- res = rtnl_neigh_set_dst(rn, nl_ipaddr);
+- if (res) {
+- wpa_printf(MSG_DEBUG,
+- "nl80211: neigh set destination addr failed");
++
++ if (nla_put(msg, NDA_DST, addrsize, (void *)ipaddr))
+ goto errout;
+- }
+
+- rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
++ res = nl_send_auto_complete(drv->rtnl_sk, msg);
++ if (res < 0)
++ goto errout;
+
+- res = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
++ res = nl_wait_for_ack(drv->rtnl_sk);
+ if (res) {
+ wpa_printf(MSG_DEBUG,
+ "nl80211: Deleting bridge ip neigh failed: %s",
+ nl_geterror(res));
+ }
+ errout:
+- if (nl_ipaddr)
+- nl_addr_put(nl_ipaddr);
+- if (rn)
+- rtnl_neigh_put(rn);
++ nlmsg_free(msg);
+ return res;
+-#else /* CONFIG_LIBNL3_ROUTE */
+- return -1;
+-#endif /* CONFIG_LIBNL3_ROUTE */
+ }
+
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/040-mesh-allow-processing-authentication-frames-in-block.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/040-mesh-allow-processing-authentication-frames-in-block.patch
new file mode 100644
index 0000000..6b34cd4
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/040-mesh-allow-processing-authentication-frames-in-block.patch
@@ -0,0 +1,34 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 18 Feb 2019 12:57:11 +0100
+Subject: [PATCH] mesh: allow processing authentication frames in blocked state
+
+If authentication fails repeatedly e.g. because of a weak signal, the link
+can end up in blocked state. If one of the nodes tries to establish a link
+again before it is unblocked on the other side, it will block the link to
+that other side. The same happens on the other side when it unblocks the
+link. In that scenario, the link never recovers on its own.
+
+To fix this, allow restarting authentication even if the link is in blocked
+state, but don't initiate the attempt until the blocked period is over.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -3781,15 +3781,6 @@ static void handle_auth(struct hostapd_d
+ seq_ctrl);
+ return;
+ }
+-#ifdef CONFIG_MESH
+- if ((hapd->conf->mesh & MESH_ENABLED) &&
+- sta->plink_state == PLINK_BLOCKED) {
+- wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
+- " is blocked - drop Authentication frame",
+- MAC2STR(mgmt->sa));
+- return;
+- }
+-#endif /* CONFIG_MESH */
+ #ifdef CONFIG_PASN
+ if (auth_alg == WLAN_AUTH_PASN &&
+ (sta->flags & WLAN_STA_ASSOC)) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/050-build_fix.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/050-build_fix.patch
new file mode 100644
index 0000000..c9268f5
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/050-build_fix.patch
@@ -0,0 +1,20 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -324,6 +324,7 @@ ifdef CONFIG_FILS
+ CFLAGS += -DCONFIG_FILS
+ OBJS += ../src/ap/fils_hlp.o
+ NEED_SHA384=y
++NEED_HMAC_SHA384_KDF=y
+ NEED_AES_SIV=y
+ ifdef CONFIG_FILS_SK_PFS
+ CFLAGS += -DCONFIG_FILS_SK_PFS
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -320,6 +320,7 @@ endif
+ ifdef CONFIG_FILS
+ CFLAGS += -DCONFIG_FILS
+ NEED_SHA384=y
++NEED_HMAC_SHA384_KDF=y
+ NEED_AES_SIV=y
+ ifdef CONFIG_FILS_SK_PFS
+ CFLAGS += -DCONFIG_FILS_SK_PFS
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/100-daemonize_fix.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/100-daemonize_fix.patch
new file mode 100644
index 0000000..687bd40
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/100-daemonize_fix.patch
@@ -0,0 +1,97 @@
+--- a/src/utils/os_unix.c
++++ b/src/utils/os_unix.c
+@@ -10,6 +10,7 @@
+
+ #include <time.h>
+ #include <sys/wait.h>
++#include <fcntl.h>
+
+ #ifdef ANDROID
+ #include <sys/capability.h>
+@@ -188,59 +189,46 @@ int os_gmtime(os_time_t t, struct os_tm
+ return 0;
+ }
+
+-
+-#ifdef __APPLE__
+-#include <fcntl.h>
+-static int os_daemon(int nochdir, int noclose)
++int os_daemonize(const char *pid_file)
+ {
+- int devnull;
++ int pid = 0, i, devnull;
+
+- if (chdir("/") < 0)
+- return -1;
++#if defined(__uClinux__) || defined(__sun__)
++ return -1;
++#else /* defined(__uClinux__) || defined(__sun__) */
+
+- devnull = open("/dev/null", O_RDWR);
+- if (devnull < 0)
++#ifndef __APPLE__
++ pid = fork();
++ if (pid < 0)
+ return -1;
++#endif
+
+- if (dup2(devnull, STDIN_FILENO) < 0) {
+- close(devnull);
+- return -1;
++ if (pid > 0) {
++ if (pid_file) {
++ FILE *f = fopen(pid_file, "w");
++ if (f) {
++ fprintf(f, "%u\n", pid);
++ fclose(f);
++ }
++ }
++ _exit(0);
+ }
+
+- if (dup2(devnull, STDOUT_FILENO) < 0) {
+- close(devnull);
++ if (setsid() < 0)
+ return -1;
+- }
+
+- if (dup2(devnull, STDERR_FILENO) < 0) {
+- close(devnull);
++ if (chdir("/") < 0)
+ return -1;
+- }
+-
+- return 0;
+-}
+-#else /* __APPLE__ */
+-#define os_daemon daemon
+-#endif /* __APPLE__ */
+
+-
+-int os_daemonize(const char *pid_file)
+-{
+-#if defined(__uClinux__) || defined(__sun__)
+- return -1;
+-#else /* defined(__uClinux__) || defined(__sun__) */
+- if (os_daemon(0, 0)) {
+- perror("daemon");
++ devnull = open("/dev/null", O_RDWR);
++ if (devnull < 0)
+ return -1;
+- }
+
+- if (pid_file) {
+- FILE *f = fopen(pid_file, "w");
+- if (f) {
+- fprintf(f, "%u\n", getpid());
+- fclose(f);
+- }
+- }
++ for (i = 0; i <= STDERR_FILENO; i++)
++ dup2(devnull, i);
++
++ if (devnull > 2)
++ close(devnull);
+
+ return -0;
+ #endif /* defined(__uClinux__) || defined(__sun__) */
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/200-multicall.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/200-multicall.patch
new file mode 100644
index 0000000..576c671
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/200-multicall.patch
@@ -0,0 +1,355 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -1,6 +1,7 @@
+ ALL=hostapd hostapd_cli
+ CONFIG_FILE = .config
+
++-include $(if $(MULTICALL), ../wpa_supplicant/.config)
+ include ../src/build.rules
+
+ ifdef LIBS
+@@ -199,7 +200,8 @@ endif
+
+ ifdef CONFIG_NO_VLAN
+ CFLAGS += -DCONFIG_NO_VLAN
+-else
++endif
++ifneq ($(findstring CONFIG_NO_VLAN,$(CFLAGS)), CONFIG_NO_VLAN)
+ OBJS += ../src/ap/vlan_init.o
+ OBJS += ../src/ap/vlan_ifconfig.o
+ OBJS += ../src/ap/vlan.o
+@@ -357,10 +359,14 @@ CFLAGS += -DCONFIG_MBO
+ OBJS += ../src/ap/mbo_ap.o
+ endif
+
++ifndef MULTICALL
++CFLAGS += -DNO_SUPPLICANT
++endif
++
+ include ../src/drivers/drivers.mak
+-OBJS += $(DRV_AP_OBJS)
+-CFLAGS += $(DRV_AP_CFLAGS)
+-LDFLAGS += $(DRV_AP_LDFLAGS)
++OBJS += $(sort $(DRV_AP_OBJS) $(if $(MULTICALL),$(DRV_WPA_OBJS)))
++CFLAGS += $(DRV_AP_CFLAGS) $(if $(MULTICALL),$(DRV_WPA_CFLAGS))
++LDFLAGS += $(DRV_AP_LDFLAGS) $(if $(MULTICALL),$(DRV_WPA_LDFLAGS))
+ LIBS += $(DRV_AP_LIBS)
+
+ ifdef CONFIG_L2_PACKET
+@@ -1291,6 +1297,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
+ _OBJS_VAR := OBJS
+ include ../src/objs.mk
+
++hostapd_multi.a: $(BCHECK) $(OBJS)
++ $(Q)$(CC) -c -o hostapd_multi.o -Dmain=hostapd_main $(CFLAGS) main.c
++ @$(E) " CC " $<
++ @rm -f $@
++ @$(AR) cr $@ hostapd_multi.o $(OBJS)
++
+ hostapd: $(OBJS)
+ $(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
+ @$(E) " LD " $@
+@@ -1365,6 +1377,12 @@ include ../src/objs.mk
+ _OBJS_VAR := SOBJS
+ include ../src/objs.mk
+
++dump_cflags:
++ @printf "%s " "$(CFLAGS)"
++
++dump_ldflags:
++ @printf "%s " "$(LDFLAGS) $(LIBS) $(EXTRALIBS)"
++
+ nt_password_hash: $(NOBJS)
+ $(Q)$(CC) $(LDFLAGS) -o nt_password_hash $(NOBJS) $(LIBS_n)
+ @$(E) " LD " $@
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -10,6 +10,7 @@ ALL += dbus/fi.w1.wpa_supplicant1.servic
+ EXTRA_TARGETS=dynamic_eap_methods
+
+ CONFIG_FILE=.config
++-include $(if $(MULTICALL),../hostapd/.config)
+ include ../src/build.rules
+
+ ifdef CONFIG_BUILD_WPA_CLIENT_SO
+@@ -371,7 +372,9 @@ endif
+ ifdef CONFIG_IBSS_RSN
+ NEED_RSN_AUTHENTICATOR=y
+ CFLAGS += -DCONFIG_IBSS_RSN
++ifndef MULTICALL
+ CFLAGS += -DCONFIG_NO_VLAN
++endif
+ OBJS += ibss_rsn.o
+ endif
+
+@@ -912,6 +915,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
+ CFLAGS += -DCONFIG_DYNAMIC_EAP_METHODS
+ LIBS += -ldl -rdynamic
+ endif
++else
++ ifdef MULTICALL
++ OBJS += ../src/eap_common/eap_common.o
++ endif
+ endif
+
+ ifdef CONFIG_AP
+@@ -919,9 +926,11 @@ NEED_EAP_COMMON=y
+ NEED_RSN_AUTHENTICATOR=y
+ CFLAGS += -DCONFIG_AP
+ OBJS += ap.o
++ifndef MULTICALL
+ CFLAGS += -DCONFIG_NO_RADIUS
+ CFLAGS += -DCONFIG_NO_ACCOUNTING
+ CFLAGS += -DCONFIG_NO_VLAN
++endif
+ OBJS += ../src/ap/hostapd.o
+ OBJS += ../src/ap/wpa_auth_glue.o
+ OBJS += ../src/ap/utils.o
+@@ -1008,6 +1017,12 @@ endif
+ ifdef CONFIG_HS20
+ OBJS += ../src/ap/hs20.o
+ endif
++else
++ ifdef MULTICALL
++ OBJS += ../src/eap_server/eap_server.o
++ OBJS += ../src/eap_server/eap_server_identity.o
++ OBJS += ../src/eap_server/eap_server_methods.o
++ endif
+ endif
+
+ ifdef CONFIG_MBO
+@@ -1016,7 +1031,9 @@ CFLAGS += -DCONFIG_MBO
+ endif
+
+ ifdef NEED_RSN_AUTHENTICATOR
++ifndef MULTICALL
+ CFLAGS += -DCONFIG_NO_RADIUS
++endif
+ NEED_AES_WRAP=y
+ OBJS += ../src/ap/wpa_auth.o
+ OBJS += ../src/ap/wpa_auth_ie.o
+@@ -1920,6 +1937,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
+
+ _OBJS_VAR := OBJS
+ include ../src/objs.mk
++wpa_supplicant_multi.a: .config $(BCHECK) $(OBJS) $(EXTRA_progs)
++ $(Q)$(CC) -c -o wpa_supplicant_multi.o -Dmain=wpa_supplicant_main $(CFLAGS) main.c
++ @$(E) " CC " $<
++ @rm -f $@
++ @$(AR) cr $@ wpa_supplicant_multi.o $(OBJS)
++
+ wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
+ $(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
+ @$(E) " LD " $@
+@@ -2052,6 +2075,12 @@ eap_gpsk.so: $(SRC_EAP_GPSK)
+ $(Q)sed -e 's|\@BINDIR\@|$(BINDIR)|g' $< >$@
+ @$(E) " sed" $<
+
++dump_cflags:
++ @printf "%s " "$(CFLAGS)"
++
++dump_ldflags:
++ @printf "%s " "$(LDFLAGS) $(LIBS) $(EXTRALIBS)"
++
+ wpa_supplicant.exe: wpa_supplicant
+ mv -f $< $@
+ wpa_cli.exe: wpa_cli
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -6171,8 +6171,8 @@ union wpa_event_data {
+ * Driver wrapper code should call this function whenever an event is received
+ * from the driver.
+ */
+-void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
+- union wpa_event_data *data);
++extern void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ /**
+ * wpa_supplicant_event_global - Report a driver event for wpa_supplicant
+@@ -6184,7 +6184,7 @@ void wpa_supplicant_event(void *ctx, enu
+ * Same as wpa_supplicant_event(), but we search for the interface in
+ * wpa_global.
+ */
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++extern void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data);
+
+ /*
+--- a/src/ap/drv_callbacks.c
++++ b/src/ap/drv_callbacks.c
+@@ -1872,8 +1872,8 @@ err:
+ #endif /* CONFIG_OWE */
+
+
+-void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
+- union wpa_event_data *data)
++void hostapd_wpa_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data)
+ {
+ struct hostapd_data *hapd = ctx;
+ #ifndef CONFIG_NO_STDOUT_DEBUG
+@@ -2145,7 +2145,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+
+
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++void hostapd_wpa_event_global(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data)
+ {
+ struct hapd_interfaces *interfaces = ctx;
+--- a/wpa_supplicant/wpa_priv.c
++++ b/wpa_supplicant/wpa_priv.c
+@@ -1038,8 +1038,8 @@ static void wpa_priv_send_ft_response(st
+ }
+
+
+-void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
+- union wpa_event_data *data)
++static void supplicant_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data)
+ {
+ struct wpa_priv_interface *iface = ctx;
+
+@@ -1102,7 +1102,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+
+
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++void supplicant_event_global(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data)
+ {
+ struct wpa_priv_global *global = ctx;
+@@ -1216,6 +1216,8 @@ int main(int argc, char *argv[])
+ if (os_program_init())
+ return -1;
+
++ wpa_supplicant_event = supplicant_event;
++ wpa_supplicant_event_global = supplicant_event_global;
+ wpa_priv_fd_workaround();
+
+ os_memset(&global, 0, sizeof(global));
+--- a/wpa_supplicant/events.c
++++ b/wpa_supplicant/events.c
+@@ -4953,8 +4953,8 @@ static void wpas_event_unprot_beacon(str
+ }
+
+
+-void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
+- union wpa_event_data *data)
++void supplicant_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data)
+ {
+ struct wpa_supplicant *wpa_s = ctx;
+ int resched;
+@@ -5813,7 +5813,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+
+
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++void supplicant_event_global(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data)
+ {
+ struct wpa_supplicant *wpa_s;
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -7087,7 +7087,6 @@ struct wpa_interface * wpa_supplicant_ma
+ return NULL;
+ }
+
+-
+ /**
+ * wpa_supplicant_match_existing - Match existing interfaces
+ * @global: Pointer to global data from wpa_supplicant_init()
+@@ -7122,6 +7121,11 @@ static int wpa_supplicant_match_existing
+
+ #endif /* CONFIG_MATCH_IFACE */
+
++extern void supplicant_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++
++extern void supplicant_event_global(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ /**
+ * wpa_supplicant_add_iface - Add a new network interface
+@@ -7378,6 +7382,8 @@ struct wpa_global * wpa_supplicant_init(
+ #ifndef CONFIG_NO_WPA_MSG
+ wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
+ #endif /* CONFIG_NO_WPA_MSG */
++ wpa_supplicant_event = supplicant_event;
++ wpa_supplicant_event_global = supplicant_event_global;
+
+ if (params->wpa_debug_file_path)
+ wpa_debug_open_file(params->wpa_debug_file_path);
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -591,6 +591,11 @@ fail:
+ return -1;
+ }
+
++void hostapd_wpa_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++
++void hostapd_wpa_event_global(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ #ifdef CONFIG_WPS
+ static int gen_uuid(const char *txt_addr)
+@@ -684,6 +689,8 @@ int main(int argc, char *argv[])
+ return -1;
+ #endif /* CONFIG_DPP */
+
++ wpa_supplicant_event = hostapd_wpa_event;
++ wpa_supplicant_event_global = hostapd_wpa_event_global;
+ for (;;) {
+ c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:q");
+ if (c < 0)
+--- a/src/drivers/drivers.c
++++ b/src/drivers/drivers.c
+@@ -10,6 +10,10 @@
+ #include "utils/common.h"
+ #include "driver.h"
+
++void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ const struct wpa_driver_ops *const wpa_drivers[] =
+ {
+--- a/wpa_supplicant/eapol_test.c
++++ b/wpa_supplicant/eapol_test.c
+@@ -31,7 +31,12 @@
+ #include "ctrl_iface.h"
+ #include "pcsc_funcs.h"
+ #include "wpas_glue.h"
++#include "drivers/driver.h"
+
++void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ const struct wpa_driver_ops *const wpa_drivers[] = { NULL };
+
+@@ -1303,6 +1308,10 @@ static void usage(void)
+ "option several times.\n");
+ }
+
++extern void supplicant_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++extern void supplicant_event_global(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ int main(int argc, char *argv[])
+ {
+@@ -1323,6 +1332,8 @@ int main(int argc, char *argv[])
+ if (os_program_init())
+ return -1;
+
++ wpa_supplicant_event = supplicant_event;
++ wpa_supplicant_event_global = supplicant_event_global;
+ hostapd_logger_register_cb(hostapd_logger_cb);
+
+ os_memset(&eapol_test, 0, sizeof(eapol_test));
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/300-noscan.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/300-noscan.patch
new file mode 100644
index 0000000..a0e00c4
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/300-noscan.patch
@@ -0,0 +1,58 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3439,6 +3439,10 @@ static int hostapd_config_fill(struct ho
+ if (bss->ocv && !bss->ieee80211w)
+ bss->ieee80211w = 1;
+ #endif /* CONFIG_OCV */
++ } else if (os_strcmp(buf, "noscan") == 0) {
++ conf->noscan = atoi(pos);
++ } else if (os_strcmp(buf, "ht_coex") == 0) {
++ conf->no_ht_coex = !atoi(pos);
+ } else if (os_strcmp(buf, "ieee80211n") == 0) {
+ conf->ieee80211n = atoi(pos);
+ } else if (os_strcmp(buf, "ht_capab") == 0) {
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1043,6 +1043,8 @@ struct hostapd_config {
+
+ int ht_op_mode_fixed;
+ u16 ht_capab;
++ int noscan;
++ int no_ht_coex;
+ int ieee80211n;
+ int secondary_channel;
+ int no_pri_sec_switch;
+--- a/src/ap/hw_features.c
++++ b/src/ap/hw_features.c
+@@ -517,7 +517,8 @@ static int ieee80211n_check_40mhz(struct
+ int ret;
+
+ /* Check that HT40 is used and PRI / SEC switch is allowed */
+- if (!iface->conf->secondary_channel || iface->conf->no_pri_sec_switch)
++ if (!iface->conf->secondary_channel || iface->conf->no_pri_sec_switch ||
++ iface->conf->noscan)
+ return 0;
+
+ hostapd_set_state(iface, HAPD_IFACE_HT_SCAN);
+--- a/src/ap/ieee802_11_ht.c
++++ b/src/ap/ieee802_11_ht.c
+@@ -230,6 +230,9 @@ void hostapd_2040_coex_action(struct hos
+ return;
+ }
+
++ if (iface->conf->noscan || iface->conf->no_ht_coex)
++ return;
++
+ if (len < IEEE80211_HDRLEN + 2 + sizeof(*bc_ie)) {
+ wpa_printf(MSG_DEBUG,
+ "Ignore too short 20/40 BSS Coexistence Management frame");
+@@ -390,6 +393,9 @@ void ht40_intolerant_add(struct hostapd_
+ if (iface->current_mode->mode != HOSTAPD_MODE_IEEE80211G)
+ return;
+
++ if (iface->conf->noscan || iface->conf->no_ht_coex)
++ return;
++
+ wpa_printf(MSG_INFO, "HT: Forty MHz Intolerant is set by STA " MACSTR
+ " in Association Request", MAC2STR(sta->addr));
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/301-mesh-noscan.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/301-mesh-noscan.patch
new file mode 100644
index 0000000..9985401
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/301-mesh-noscan.patch
@@ -0,0 +1,71 @@
+--- a/wpa_supplicant/config.c
++++ b/wpa_supplicant/config.c
+@@ -2555,6 +2555,7 @@ static const struct parse_data ssid_fiel
+ #else /* CONFIG_MESH */
+ { INT_RANGE(mode, 0, 4) },
+ #endif /* CONFIG_MESH */
++ { INT_RANGE(noscan, 0, 1) },
+ { INT_RANGE(proactive_key_caching, 0, 1) },
+ { INT_RANGE(disabled, 0, 2) },
+ { STR(id_str) },
+--- a/wpa_supplicant/config_file.c
++++ b/wpa_supplicant/config_file.c
+@@ -766,6 +766,7 @@ static void wpa_config_write_network(FIL
+ #endif /* IEEE8021X_EAPOL */
+ INT(mode);
+ INT(no_auto_peer);
++ INT(noscan);
+ INT(mesh_fwding);
+ INT(frequency);
+ INT(enable_edmg);
+--- a/wpa_supplicant/mesh.c
++++ b/wpa_supplicant/mesh.c
+@@ -506,6 +506,8 @@ static int wpa_supplicant_mesh_init(stru
+ frequency);
+ goto out_free;
+ }
++ if (ssid->noscan)
++ conf->noscan = 1;
+
+ if (ssid->mesh_basic_rates == NULL) {
+ /*
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -2463,7 +2463,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ int ieee80211_mode = wpas_mode_to_ieee80211_mode(ssid->mode);
+ enum hostapd_hw_mode hw_mode;
+ struct hostapd_hw_modes *mode = NULL;
+- int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
++ int ht40plus[] = { 1, 2, 3, 4, 5, 6, 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
+ 184, 192 };
+ int bw80[] = { 5180, 5260, 5500, 5580, 5660, 5745, 5955,
+ 6035, 6115, 6195, 6275, 6355, 6435, 6515,
+@@ -2471,7 +2471,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ int bw160[] = { 5955, 6115, 6275, 6435, 6595, 6755, 6915 };
+ struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
+ u8 channel;
+- int i, chan_idx, ht40 = -1, res, obss_scan = 1;
++ int i, chan_idx, ht40 = -1, res, obss_scan = !(ssid->noscan);
+ unsigned int j, k;
+ struct hostapd_freq_params vht_freq;
+ int chwidth, seg0, seg1;
+@@ -2562,7 +2562,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ #endif /* CONFIG_HE_OVERRIDES */
+
+ /* Setup higher BW only for 5 GHz */
+- if (mode->mode != HOSTAPD_MODE_IEEE80211A)
++ if (mode->mode != HOSTAPD_MODE_IEEE80211A && !(ssid->noscan))
+ return;
+
+ for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
+--- a/wpa_supplicant/config_ssid.h
++++ b/wpa_supplicant/config_ssid.h
+@@ -981,6 +981,8 @@ struct wpa_ssid {
+ */
+ int no_auto_peer;
+
++ int noscan;
++
+ /**
+ * mesh_rssi_threshold - Set mesh parameter mesh_rssi_threshold (dBm)
+ *
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/310-rescan_immediately.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/310-rescan_immediately.patch
new file mode 100644
index 0000000..2c25419
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/310-rescan_immediately.patch
@@ -0,0 +1,11 @@
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -5419,7 +5419,7 @@ wpa_supplicant_alloc(struct wpa_supplica
+ if (wpa_s == NULL)
+ return NULL;
+ wpa_s->scan_req = INITIAL_SCAN_REQ;
+- wpa_s->scan_interval = 5;
++ wpa_s->scan_interval = 1;
+ wpa_s->new_connection = 1;
+ wpa_s->parent = parent ? parent : wpa_s;
+ wpa_s->p2pdev = wpa_s->parent;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/320-optional_rfkill.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/320-optional_rfkill.patch
new file mode 100644
index 0000000..0153779
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/320-optional_rfkill.patch
@@ -0,0 +1,61 @@
+--- a/src/drivers/drivers.mak
++++ b/src/drivers/drivers.mak
+@@ -54,7 +54,6 @@ NEED_SME=y
+ NEED_AP_MLME=y
+ NEED_NETLINK=y
+ NEED_LINUX_IOCTL=y
+-NEED_RFKILL=y
+ NEED_RADIOTAP=y
+ NEED_LIBNL=y
+ endif
+@@ -111,7 +110,6 @@ DRV_WPA_CFLAGS += -DCONFIG_DRIVER_WEXT
+ CONFIG_WIRELESS_EXTENSION=y
+ NEED_NETLINK=y
+ NEED_LINUX_IOCTL=y
+-NEED_RFKILL=y
+ endif
+
+ ifdef CONFIG_DRIVER_NDIS
+@@ -137,7 +135,6 @@ endif
+ ifdef CONFIG_WIRELESS_EXTENSION
+ DRV_WPA_CFLAGS += -DCONFIG_WIRELESS_EXTENSION
+ DRV_WPA_OBJS += ../src/drivers/driver_wext.o
+-NEED_RFKILL=y
+ endif
+
+ ifdef NEED_NETLINK
+@@ -146,6 +143,7 @@ endif
+
+ ifdef NEED_RFKILL
+ DRV_OBJS += ../src/drivers/rfkill.o
++DRV_WPA_CFLAGS += -DCONFIG_RFKILL
+ endif
+
+ ifdef NEED_RADIOTAP
+--- a/src/drivers/rfkill.h
++++ b/src/drivers/rfkill.h
+@@ -18,8 +18,24 @@ struct rfkill_config {
+ void (*unblocked_cb)(void *ctx);
+ };
+
++#ifdef CONFIG_RFKILL
+ struct rfkill_data * rfkill_init(struct rfkill_config *cfg);
+ void rfkill_deinit(struct rfkill_data *rfkill);
+ int rfkill_is_blocked(struct rfkill_data *rfkill);
++#else
++static inline struct rfkill_data * rfkill_init(struct rfkill_config *cfg)
++{
++ return (void *) 1;
++}
++
++static inline void rfkill_deinit(struct rfkill_data *rfkill)
++{
++}
++
++static inline int rfkill_is_blocked(struct rfkill_data *rfkill)
++{
++ return 0;
++}
++#endif
+
+ #endif /* RFKILL_H */
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/330-nl80211_fix_set_freq.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/330-nl80211_fix_set_freq.patch
new file mode 100644
index 0000000..8218a43
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/330-nl80211_fix_set_freq.patch
@@ -0,0 +1,11 @@
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -5022,7 +5022,7 @@ static int nl80211_set_channel(struct i8
+ freq->he_enabled, freq->eht_enabled, freq->bandwidth,
+ freq->center_freq1, freq->center_freq2);
+
+- msg = nl80211_drv_msg(drv, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
++ msg = nl80211_bss_msg(bss, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
+ NL80211_CMD_SET_WIPHY);
+ if (!msg || nl80211_put_freq_params(msg, freq) < 0) {
+ nlmsg_free(msg);
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/340-reload_freq_change.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/340-reload_freq_change.patch
new file mode 100644
index 0000000..b591074
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/340-reload_freq_change.patch
@@ -0,0 +1,76 @@
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -119,6 +119,29 @@ static void hostapd_reload_bss(struct ho
+ #endif /* CONFIG_NO_RADIUS */
+
+ ssid = &hapd->conf->ssid;
++
++ hostapd_set_freq(hapd, hapd->iconf->hw_mode, hapd->iface->freq,
++ hapd->iconf->channel,
++ hapd->iconf->enable_edmg,
++ hapd->iconf->edmg_channel,
++ hapd->iconf->ieee80211n,
++ hapd->iconf->ieee80211ac,
++ hapd->iconf->ieee80211ax,
++ hapd->iconf->ieee80211be,
++ hapd->iconf->secondary_channel,
++ hostapd_get_oper_chwidth(hapd->iconf),
++ hostapd_get_oper_centr_freq_seg0_idx(hapd->iconf),
++ hostapd_get_oper_centr_freq_seg1_idx(hapd->iconf));
++
++ if (hapd->iface->current_mode) {
++ if (hostapd_prepare_rates(hapd->iface, hapd->iface->current_mode)) {
++ wpa_printf(MSG_ERROR, "Failed to prepare rates table.");
++ hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
++ HOSTAPD_LEVEL_WARNING,
++ "Failed to prepare rates table.");
++ }
++ }
++
+ if (!ssid->wpa_psk_set && ssid->wpa_psk && !ssid->wpa_psk->next &&
+ ssid->wpa_passphrase_set && ssid->wpa_passphrase) {
+ /*
+@@ -220,6 +243,7 @@ int hostapd_reload_config(struct hostapd
+ struct hostapd_data *hapd = iface->bss[0];
+ struct hostapd_config *newconf, *oldconf;
+ size_t j;
++ int i;
+
+ if (iface->config_fname == NULL) {
+ /* Only in-memory config in use - assume it has been updated */
+@@ -270,24 +294,20 @@ int hostapd_reload_config(struct hostapd
+ }
+ iface->conf = newconf;
+
++ for (i = 0; i < iface->num_hw_features; i++) {
++ struct hostapd_hw_modes *mode = &iface->hw_features[i];
++ if (mode->mode == iface->conf->hw_mode) {
++ iface->current_mode = mode;
++ break;
++ }
++ }
++
++ if (iface->conf->channel)
++ iface->freq = hostapd_hw_get_freq(hapd, iface->conf->channel);
++
+ for (j = 0; j < iface->num_bss; j++) {
+ hapd = iface->bss[j];
+ hapd->iconf = newconf;
+- hapd->iconf->channel = oldconf->channel;
+- hapd->iconf->acs = oldconf->acs;
+- hapd->iconf->secondary_channel = oldconf->secondary_channel;
+- hapd->iconf->ieee80211n = oldconf->ieee80211n;
+- hapd->iconf->ieee80211ac = oldconf->ieee80211ac;
+- hapd->iconf->ht_capab = oldconf->ht_capab;
+- hapd->iconf->vht_capab = oldconf->vht_capab;
+- hostapd_set_oper_chwidth(hapd->iconf,
+- hostapd_get_oper_chwidth(oldconf));
+- hostapd_set_oper_centr_freq_seg0_idx(
+- hapd->iconf,
+- hostapd_get_oper_centr_freq_seg0_idx(oldconf));
+- hostapd_set_oper_centr_freq_seg1_idx(
+- hapd->iconf,
+- hostapd_get_oper_centr_freq_seg1_idx(oldconf));
+ hapd->conf = newconf->bss[j];
+ hostapd_reload_bss(hapd);
+ }
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/341-mesh-ctrl-iface-channel-switch.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/341-mesh-ctrl-iface-channel-switch.patch
new file mode 100644
index 0000000..29a3799
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/341-mesh-ctrl-iface-channel-switch.patch
@@ -0,0 +1,39 @@
+--- a/wpa_supplicant/ap.c
++++ b/wpa_supplicant/ap.c
+@@ -1803,15 +1803,35 @@ int ap_switch_channel(struct wpa_supplic
+
+
+ #ifdef CONFIG_CTRL_IFACE
++
++static int __ap_ctrl_iface_chanswitch(struct hostapd_iface *iface,
++ struct csa_settings *settings)
++{
++#ifdef NEED_AP_MLME
++ if (!iface || !iface->bss[0])
++ return 0;
++
++ return hostapd_switch_channel(iface->bss[0], settings);
++#else
++ return -1;
++#endif
++}
++
++
+ int ap_ctrl_iface_chanswitch(struct wpa_supplicant *wpa_s, const char *pos)
+ {
+ struct csa_settings settings;
+ int ret = hostapd_parse_csa_settings(pos, &settings);
+
++ if (!(wpa_s->ap_iface && wpa_s->ap_iface->bss[0]) &&
++ !(wpa_s->ifmsh && wpa_s->ifmsh->bss[0]))
++ return -1;
++
++ ret = __ap_ctrl_iface_chanswitch(wpa_s->ap_iface, &settings);
+ if (ret)
+ return ret;
+
+- return ap_switch_channel(wpa_s, &settings);
++ return __ap_ctrl_iface_chanswitch(wpa_s->ifmsh, &settings);
+ }
+ #endif /* CONFIG_CTRL_IFACE */
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/350-nl80211_del_beacon_bss.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/350-nl80211_del_beacon_bss.patch
new file mode 100644
index 0000000..85298df
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/350-nl80211_del_beacon_bss.patch
@@ -0,0 +1,34 @@
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -2938,11 +2938,11 @@ static int wpa_driver_nl80211_del_beacon
+ struct wpa_driver_nl80211_data *drv = bss->drv;
+
+ wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
+- drv->ifindex);
++ bss->ifindex);
+ bss->beacon_set = 0;
+ bss->freq = 0;
+ nl80211_put_wiphy_data_ap(bss);
+- msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
++ msg = nl80211_bss_msg(drv, 0, NL80211_CMD_DEL_BEACON);
+ return send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
+ }
+
+@@ -5661,7 +5661,7 @@ static void nl80211_teardown_ap(struct i
+ nl80211_mgmt_unsubscribe(bss, "AP teardown");
+
+ nl80211_put_wiphy_data_ap(bss);
+- bss->beacon_set = 0;
++ wpa_driver_nl80211_del_beacon(bss);
+ }
+
+
+@@ -8120,8 +8120,6 @@ static int wpa_driver_nl80211_if_remove(
+ } else {
+ wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
+ nl80211_teardown_ap(bss);
+- if (!bss->added_if && !drv->first_bss->next)
+- wpa_driver_nl80211_del_beacon(bss);
+ nl80211_destroy_bss(bss);
+ if (!bss->added_if)
+ i802_set_iface_flags(bss, 0);
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/360-ctrl_iface_reload.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/360-ctrl_iface_reload.patch
new file mode 100644
index 0000000..7699541
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/360-ctrl_iface_reload.patch
@@ -0,0 +1,106 @@
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -67,6 +67,7 @@
+ #include "fst/fst_ctrl_iface.h"
+ #include "config_file.h"
+ #include "ctrl_iface.h"
++#include "config_file.h"
+
+
+ #define HOSTAPD_CLI_DUP_VALUE_MAX_LEN 256
+@@ -82,6 +83,7 @@ static void hostapd_ctrl_iface_send(stru
+ enum wpa_msg_type type,
+ const char *buf, size_t len);
+
++static char *reload_opts = NULL;
+
+ static int hostapd_ctrl_iface_attach(struct hostapd_data *hapd,
+ struct sockaddr_storage *from,
+@@ -133,6 +135,61 @@ static int hostapd_ctrl_iface_new_sta(st
+ return 0;
+ }
+
++static char *get_option(char *opt, char *str)
++{
++ int len = strlen(str);
++
++ if (!strncmp(opt, str, len))
++ return opt + len;
++ else
++ return NULL;
++}
++
++static struct hostapd_config *hostapd_ctrl_iface_config_read(const char *fname)
++{
++ struct hostapd_config *conf;
++ char *opt, *val;
++
++ conf = hostapd_config_read(fname);
++ if (!conf)
++ return NULL;
++
++ for (opt = strtok(reload_opts, " ");
++ opt;
++ opt = strtok(NULL, " ")) {
++
++ if ((val = get_option(opt, "channel=")))
++ conf->channel = atoi(val);
++ else if ((val = get_option(opt, "ht_capab=")))
++ conf->ht_capab = atoi(val);
++ else if ((val = get_option(opt, "ht_capab_mask=")))
++ conf->ht_capab &= atoi(val);
++ else if ((val = get_option(opt, "sec_chan=")))
++ conf->secondary_channel = atoi(val);
++ else if ((val = get_option(opt, "hw_mode=")))
++ conf->hw_mode = atoi(val);
++ else if ((val = get_option(opt, "ieee80211n=")))
++ conf->ieee80211n = atoi(val);
++ else
++ break;
++ }
++
++ return conf;
++}
++
++static int hostapd_ctrl_iface_update(struct hostapd_data *hapd, char *txt)
++{
++ struct hostapd_config * (*config_read_cb)(const char *config_fname);
++ struct hostapd_iface *iface = hapd->iface;
++
++ config_read_cb = iface->interfaces->config_read_cb;
++ iface->interfaces->config_read_cb = hostapd_ctrl_iface_config_read;
++ reload_opts = txt;
++
++ hostapd_reload_config(iface);
++
++ iface->interfaces->config_read_cb = config_read_cb;
++}
+
+ #ifdef NEED_AP_MLME
+ static int hostapd_ctrl_iface_sa_query(struct hostapd_data *hapd,
+@@ -3449,6 +3506,8 @@ static int hostapd_ctrl_iface_receive_pr
+ } else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
+ reply_len = hostapd_ctrl_iface_vendor(hapd, buf + 7, reply,
+ reply_size);
++ } else if (os_strncmp(buf, "UPDATE ", 7) == 0) {
++ hostapd_ctrl_iface_update(hapd, buf + 7);
+ } else if (os_strcmp(buf, "ERP_FLUSH") == 0) {
+ ieee802_1x_erp_flush(hapd);
+ #ifdef RADIUS_SERVER
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -945,7 +945,13 @@ int hostapd_parse_csa_settings(const cha
+
+ int hostapd_ctrl_iface_stop_ap(struct hostapd_data *hapd)
+ {
+- return hostapd_drv_stop_ap(hapd);
++ struct hostapd_iface *iface = hapd->iface;
++ int i;
++
++ for (i = 0; i < iface->num_bss; i++)
++ hostapd_drv_stop_ap(iface->bss[i]);
++
++ return 0;
+ }
+
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/370-ap_sta_support.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/370-ap_sta_support.patch
new file mode 100644
index 0000000..6faaffc
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/370-ap_sta_support.patch
@@ -0,0 +1,393 @@
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -115,6 +115,8 @@ OBJS_c += ../src/utils/common.o
+ OBJS_c += ../src/common/cli.o
+ OBJS += wmm_ac.o
+
++OBJS += ../src/common/wpa_ctrl.o
++
+ ifndef CONFIG_OS
+ ifdef CONFIG_NATIVE_WINDOWS
+ CONFIG_OS=win32
+--- a/wpa_supplicant/bss.c
++++ b/wpa_supplicant/bss.c
+@@ -11,6 +11,7 @@
+ #include "utils/common.h"
+ #include "utils/eloop.h"
+ #include "common/ieee802_11_defs.h"
++#include "common/ieee802_11_common.h"
+ #include "drivers/driver.h"
+ #include "eap_peer/eap.h"
+ #include "wpa_supplicant_i.h"
+@@ -282,6 +283,10 @@ void calculate_update_time(const struct
+ static void wpa_bss_copy_res(struct wpa_bss *dst, struct wpa_scan_res *src,
+ struct os_reltime *fetch_time)
+ {
++ struct ieee80211_ht_capabilities *capab;
++ struct ieee80211_ht_operation *oper;
++ struct ieee802_11_elems elems;
++
+ dst->flags = src->flags;
+ os_memcpy(dst->bssid, src->bssid, ETH_ALEN);
+ dst->freq = src->freq;
+@@ -295,6 +300,15 @@ static void wpa_bss_copy_res(struct wpa_
+ dst->est_throughput = src->est_throughput;
+ dst->snr = src->snr;
+
++ memset(&elems, 0, sizeof(elems));
++ ieee802_11_parse_elems((u8 *) (src + 1), src->ie_len, &elems, 0);
++ capab = (struct ieee80211_ht_capabilities *) elems.ht_capabilities;
++ oper = (struct ieee80211_ht_operation *) elems.ht_operation;
++ if (capab)
++ dst->ht_capab = le_to_host16(capab->ht_capabilities_info);
++ if (oper)
++ dst->ht_param = oper->ht_param;
++
+ calculate_update_time(fetch_time, src->age, &dst->last_update);
+ }
+
+--- a/wpa_supplicant/bss.h
++++ b/wpa_supplicant/bss.h
+@@ -94,6 +94,10 @@ struct wpa_bss {
+ u8 ssid[SSID_MAX_LEN];
+ /** Length of SSID */
+ size_t ssid_len;
++ /** HT capabilities */
++ u16 ht_capab;
++ /* Five octets of HT Operation Information */
++ u8 ht_param;
+ /** Frequency of the channel in MHz (e.g., 2412 = channel 1) */
+ int freq;
+ /** Beacon interval in TUs (host byte order) */
+--- a/wpa_supplicant/main.c
++++ b/wpa_supplicant/main.c
+@@ -35,7 +35,7 @@ static void usage(void)
+ "vW] [-P<pid file>] "
+ "[-g<global ctrl>] \\\n"
+ " [-G<group>] \\\n"
+- " -i<ifname> -c<config file> [-C<ctrl>] [-D<driver>] "
++ " -i<ifname> -c<config file> [-C<ctrl>] [-D<driver>] [-H<hostapd path>] "
+ "[-p<driver_param>] \\\n"
+ " [-b<br_ifname>] [-e<entropy file>]"
+ #ifdef CONFIG_DEBUG_FILE
+@@ -75,6 +75,7 @@ static void usage(void)
+ " -g = global ctrl_interface\n"
+ " -G = global ctrl_interface group\n"
+ " -h = show this help text\n"
++ " -H = connect to a hostapd instance to manage state changes\n"
+ " -i = interface name\n"
+ " -I = additional configuration file\n"
+ " -K = include keys (passwords, etc.) in debug output\n"
+@@ -202,7 +203,7 @@ int main(int argc, char *argv[])
+
+ for (;;) {
+ c = getopt(argc, argv,
+- "b:Bc:C:D:de:f:g:G:hi:I:KLMm:No:O:p:P:qsTtuvW");
++ "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuvW");
+ if (c < 0)
+ break;
+ switch (c) {
+@@ -249,6 +250,9 @@ int main(int argc, char *argv[])
+ usage();
+ exitcode = 0;
+ goto out;
++ case 'H':
++ iface->hostapd_ctrl = optarg;
++ break;
+ case 'i':
+ iface->ifname = optarg;
+ break;
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -131,6 +131,54 @@ static void wpas_update_fils_connect_par
+ static void wpas_update_owe_connect_params(struct wpa_supplicant *wpa_s);
+ #endif /* CONFIG_OWE */
+
++static int hostapd_stop(struct wpa_supplicant *wpa_s)
++{
++ const char *cmd = "STOP_AP";
++ char buf[256];
++ size_t len = sizeof(buf);
++
++ if (wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL) < 0) {
++ wpa_printf(MSG_ERROR, "\nFailed to stop hostapd AP interfaces\n");
++ return -1;
++ }
++ return 0;
++}
++
++static int hostapd_reload(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
++{
++ char *cmd = NULL;
++ char buf[256];
++ size_t len = sizeof(buf);
++ enum hostapd_hw_mode hw_mode;
++ u8 channel;
++ int sec_chan = 0;
++ int ret;
++
++ if (!bss)
++ return -1;
++
++ if (bss->ht_param & HT_INFO_HT_PARAM_STA_CHNL_WIDTH) {
++ int sec = bss->ht_param & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
++ if (sec == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
++ sec_chan = 1;
++ else if (sec == HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
++ sec_chan = -1;
++ }
++
++ hw_mode = ieee80211_freq_to_chan(bss->freq, &channel);
++ if (asprintf(&cmd, "UPDATE channel=%d sec_chan=%d hw_mode=%d",
++ channel, sec_chan, hw_mode) < 0)
++ return -1;
++
++ ret = wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL);
++ free(cmd);
++
++ if (ret < 0) {
++ wpa_printf(MSG_ERROR, "\nFailed to reload hostapd AP interfaces\n");
++ return -1;
++ }
++ return 0;
++}
+
+ #ifdef CONFIG_WEP
+ /* Configure default/group WEP keys for static WEP */
+@@ -1016,6 +1064,8 @@ void wpa_supplicant_set_state(struct wpa
+
+ sme_sched_obss_scan(wpa_s, 1);
+
++ if (wpa_s->hostapd)
++ hostapd_reload(wpa_s, wpa_s->current_bss);
+ #if defined(CONFIG_FILS) && defined(IEEE8021X_EAPOL)
+ if (!fils_hlp_sent && ssid && ssid->eap.erp)
+ update_fils_connect_params = true;
+@@ -1026,6 +1076,8 @@ void wpa_supplicant_set_state(struct wpa
+ #endif /* CONFIG_OWE */
+ } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
+ state == WPA_ASSOCIATED) {
++ if (wpa_s->hostapd)
++ hostapd_stop(wpa_s);
+ wpa_s->new_connection = 1;
+ wpa_drv_set_operstate(wpa_s, 0);
+ #ifndef IEEE8021X_EAPOL
+@@ -2335,6 +2387,8 @@ void wpa_supplicant_associate(struct wpa
+ return;
+ }
+ wpa_s->current_bss = bss;
++ if (wpa_s->hostapd)
++ hostapd_reload(wpa_s, wpa_s->current_bss);
+ #else /* CONFIG_MESH */
+ wpa_msg(wpa_s, MSG_ERROR,
+ "mesh mode support not included in the build");
+@@ -6693,6 +6747,16 @@ static int wpa_supplicant_init_iface(str
+ sizeof(wpa_s->bridge_ifname));
+ }
+
++ if (iface->hostapd_ctrl) {
++ wpa_s->hostapd = wpa_ctrl_open(iface->hostapd_ctrl);
++ if (!wpa_s->hostapd) {
++ wpa_printf(MSG_ERROR, "\nFailed to connect to hostapd\n");
++ return -1;
++ }
++ if (hostapd_stop(wpa_s) < 0)
++ return -1;
++ }
++
+ /* RSNA Supplicant Key Management - INITIALIZE */
+ eapol_sm_notify_portEnabled(wpa_s->eapol, false);
+ eapol_sm_notify_portValid(wpa_s->eapol, false);
+@@ -7031,6 +7095,11 @@ static void wpa_supplicant_deinit_iface(
+ if (terminate)
+ wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
+
++ if (wpa_s->hostapd) {
++ wpa_ctrl_close(wpa_s->hostapd);
++ wpa_s->hostapd = NULL;
++ }
++
+ wpa_supplicant_ctrl_iface_deinit(wpa_s, wpa_s->ctrl_iface);
+ wpa_s->ctrl_iface = NULL;
+
+--- a/wpa_supplicant/wpa_supplicant_i.h
++++ b/wpa_supplicant/wpa_supplicant_i.h
+@@ -105,6 +105,11 @@ struct wpa_interface {
+ const char *ifname;
+
+ /**
++ * hostapd_ctrl - path to hostapd control socket for notification
++ */
++ const char *hostapd_ctrl;
++
++ /**
+ * bridge_ifname - Optional bridge interface name
+ *
+ * If the driver interface (ifname) is included in a Linux bridge
+@@ -717,6 +722,8 @@ struct wpa_supplicant {
+ #endif /* CONFIG_CTRL_IFACE_BINDER */
+ char bridge_ifname[16];
+
++ struct wpa_ctrl *hostapd;
++
+ char *confname;
+ char *confanother;
+
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -2641,6 +2641,12 @@ static int hostapd_ctrl_iface_chan_switc
+ return 0;
+ }
+
++ if (os_strstr(pos, " auto-ht")) {
++ settings.freq_params.ht_enabled = iface->conf->ieee80211n;
++ settings.freq_params.vht_enabled = iface->conf->ieee80211ac;
++ settings.freq_params.he_enabled = iface->conf->ieee80211ax;
++ }
++
+ for (i = 0; i < iface->num_bss; i++) {
+
+ /* Save CHAN_SWITCH VHT, HE, and EHT config */
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1903,11 +1903,6 @@ static int __ieee802_11_set_beacon(struc
+ return -1;
+ }
+
+- if (hapd->csa_in_progress) {
+- wpa_printf(MSG_ERROR, "Cannot set beacons during CSA period");
+- return -1;
+- }
+-
+ hapd->beacon_set_done = 1;
+
+ if (ieee802_11_build_ap_params(hapd, ¶ms) < 0)
+--- a/wpa_supplicant/events.c
++++ b/wpa_supplicant/events.c
+@@ -4953,6 +4953,60 @@ static void wpas_event_unprot_beacon(str
+ }
+
+
++static void
++supplicant_ch_switch_started(struct wpa_supplicant *wpa_s,
++ union wpa_event_data *data)
++{
++ char buf[256];
++ size_t len = sizeof(buf);
++ char *cmd = NULL;
++ int width = 20;
++ int ret;
++
++ if (!wpa_s->hostapd)
++ return;
++
++ wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CHANNEL_SWITCH
++ "count=%d freq=%d ht_enabled=%d ch_offset=%d ch_width=%s cf1=%d cf2=%d",
++ data->ch_switch.count,
++ data->ch_switch.freq,
++ data->ch_switch.ht_enabled,
++ data->ch_switch.ch_offset,
++ channel_width_to_string(data->ch_switch.ch_width),
++ data->ch_switch.cf1,
++ data->ch_switch.cf2);
++
++ switch (data->ch_switch.ch_width) {
++ case CHAN_WIDTH_20_NOHT:
++ case CHAN_WIDTH_20:
++ width = 20;
++ break;
++ case CHAN_WIDTH_40:
++ width = 40;
++ break;
++ case CHAN_WIDTH_80:
++ width = 80;
++ break;
++ case CHAN_WIDTH_160:
++ case CHAN_WIDTH_80P80:
++ width = 160;
++ break;
++ }
++
++ asprintf(&cmd, "CHAN_SWITCH %d %d sec_channel_offset=%d center_freq1=%d center_freq2=%d, bandwidth=%d auto-ht\n",
++ data->ch_switch.count - 1,
++ data->ch_switch.freq,
++ data->ch_switch.ch_offset,
++ data->ch_switch.cf1,
++ data->ch_switch.cf2,
++ width);
++ ret = wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL);
++ free(cmd);
++
++ if (ret < 0)
++ wpa_printf(MSG_ERROR, "\nFailed to reload hostapd AP interfaces\n");
++}
++
+ void supplicant_event(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data)
+ {
+@@ -5268,8 +5322,10 @@ void supplicant_event(void *ctx, enum wp
+ channel_width_to_string(data->ch_switch.ch_width),
+ data->ch_switch.cf1,
+ data->ch_switch.cf2);
+- if (event == EVENT_CH_SWITCH_STARTED)
++ if (event == EVENT_CH_SWITCH_STARTED) {
++ supplicant_ch_switch_started(wpa_s, data);
+ break;
++ }
+
+ wpa_s->assoc_freq = data->ch_switch.freq;
+ wpa_s->current_ssid->frequency = data->ch_switch.freq;
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -5968,6 +5968,7 @@ union wpa_event_data {
+
+ /**
+ * struct ch_switch
++ * @count: Count until channel switch activates
+ * @freq: Frequency of new channel in MHz
+ * @ht_enabled: Whether this is an HT channel
+ * @ch_offset: Secondary channel offset
+@@ -5976,6 +5977,7 @@ union wpa_event_data {
+ * @cf2: Center frequency 2
+ */
+ struct ch_switch {
++ int count;
+ int freq;
+ int ht_enabled;
+ int ch_offset;
+--- a/src/drivers/driver_nl80211_event.c
++++ b/src/drivers/driver_nl80211_event.c
+@@ -694,7 +694,7 @@ static void mlme_event_ch_switch(struct
+ struct nlattr *ifindex, struct nlattr *freq,
+ struct nlattr *type, struct nlattr *bw,
+ struct nlattr *cf1, struct nlattr *cf2,
+- int finished)
++ struct nlattr *count, int finished)
+ {
+ struct i802_bss *bss;
+ union wpa_event_data data;
+@@ -755,6 +755,8 @@ static void mlme_event_ch_switch(struct
+ data.ch_switch.cf1 = nla_get_u32(cf1);
+ if (cf2)
+ data.ch_switch.cf2 = nla_get_u32(cf2);
++ if (count)
++ data.ch_switch.count = nla_get_u32(count);
+
+ if (finished)
+ bss->freq = data.ch_switch.freq;
+@@ -3113,6 +3115,7 @@ static void do_process_drv_event(struct
+ tb[NL80211_ATTR_CHANNEL_WIDTH],
+ tb[NL80211_ATTR_CENTER_FREQ1],
+ tb[NL80211_ATTR_CENTER_FREQ2],
++ tb[NL80211_ATTR_CH_SWITCH_COUNT],
+ 0);
+ break;
+ case NL80211_CMD_CH_SWITCH_NOTIFY:
+@@ -3123,6 +3126,7 @@ static void do_process_drv_event(struct
+ tb[NL80211_ATTR_CHANNEL_WIDTH],
+ tb[NL80211_ATTR_CENTER_FREQ1],
+ tb[NL80211_ATTR_CENTER_FREQ2],
++ NULL,
+ 1);
+ break;
+ case NL80211_CMD_DISCONNECT:
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/380-disable_ctrl_iface_mib.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/380-disable_ctrl_iface_mib.patch
new file mode 100644
index 0000000..1f78c42
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/380-disable_ctrl_iface_mib.patch
@@ -0,0 +1,193 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -221,6 +221,9 @@ endif
+ ifdef CONFIG_NO_CTRL_IFACE
+ CFLAGS += -DCONFIG_NO_CTRL_IFACE
+ else
++ifdef CONFIG_CTRL_IFACE_MIB
++CFLAGS += -DCONFIG_CTRL_IFACE_MIB
++endif
+ ifeq ($(CONFIG_CTRL_IFACE), udp)
+ CFLAGS += -DCONFIG_CTRL_IFACE_UDP
+ else
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3265,6 +3265,7 @@ static int hostapd_ctrl_iface_receive_pr
+ reply_size);
+ } else if (os_strcmp(buf, "STATUS-DRIVER") == 0) {
+ reply_len = hostapd_drv_status(hapd, reply, reply_size);
++#ifdef CONFIG_CTRL_IFACE_MIB
+ } else if (os_strcmp(buf, "MIB") == 0) {
+ reply_len = ieee802_11_get_mib(hapd, reply, reply_size);
+ if (reply_len >= 0) {
+@@ -3306,6 +3307,7 @@ static int hostapd_ctrl_iface_receive_pr
+ } else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
+ reply_len = hostapd_ctrl_iface_sta_next(hapd, buf + 9, reply,
+ reply_size);
++#endif
+ } else if (os_strcmp(buf, "ATTACH") == 0) {
+ if (hostapd_ctrl_iface_attach(hapd, from, fromlen, NULL))
+ reply_len = -1;
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -973,6 +973,9 @@ ifdef CONFIG_FILS
+ OBJS += ../src/ap/fils_hlp.o
+ endif
+ ifdef CONFIG_CTRL_IFACE
++ifdef CONFIG_CTRL_IFACE_MIB
++CFLAGS += -DCONFIG_CTRL_IFACE_MIB
++endif
+ OBJS += ../src/ap/ctrl_iface_ap.o
+ endif
+
+--- a/wpa_supplicant/ctrl_iface.c
++++ b/wpa_supplicant/ctrl_iface.c
+@@ -2325,7 +2325,7 @@ static int wpa_supplicant_ctrl_iface_sta
+ pos += ret;
+ }
+
+-#ifdef CONFIG_AP
++#if defined(CONFIG_AP) && defined(CONFIG_CTRL_IFACE_MIB)
+ if (wpa_s->ap_iface) {
+ pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
+ end - pos,
+@@ -11565,6 +11565,7 @@ char * wpa_supplicant_ctrl_iface_process
+ reply_len = -1;
+ } else if (os_strncmp(buf, "NOTE ", 5) == 0) {
+ wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
++#ifdef CONFIG_CTRL_IFACE_MIB
+ } else if (os_strcmp(buf, "MIB") == 0) {
+ reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
+ if (reply_len >= 0) {
+@@ -11577,6 +11578,7 @@ char * wpa_supplicant_ctrl_iface_process
+ reply_size - reply_len);
+ #endif /* CONFIG_MACSEC */
+ }
++#endif
+ } else if (os_strncmp(buf, "STATUS", 6) == 0) {
+ reply_len = wpa_supplicant_ctrl_iface_status(
+ wpa_s, buf + 6, reply, reply_size);
+@@ -12065,6 +12067,7 @@ char * wpa_supplicant_ctrl_iface_process
+ reply_len = wpa_supplicant_ctrl_iface_bss(
+ wpa_s, buf + 4, reply, reply_size);
+ #ifdef CONFIG_AP
++#ifdef CONFIG_CTRL_IFACE_MIB
+ } else if (os_strcmp(buf, "STA-FIRST") == 0) {
+ reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
+ } else if (os_strncmp(buf, "STA ", 4) == 0) {
+@@ -12073,12 +12076,15 @@ char * wpa_supplicant_ctrl_iface_process
+ } else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
+ reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
+ reply_size);
++#endif
++#ifdef CONFIG_CTRL_IFACE_MIB
+ } else if (os_strncmp(buf, "DEAUTHENTICATE ", 15) == 0) {
+ if (ap_ctrl_iface_sta_deauthenticate(wpa_s, buf + 15))
+ reply_len = -1;
+ } else if (os_strncmp(buf, "DISASSOCIATE ", 13) == 0) {
+ if (ap_ctrl_iface_sta_disassociate(wpa_s, buf + 13))
+ reply_len = -1;
++#endif
+ } else if (os_strncmp(buf, "CHAN_SWITCH ", 12) == 0) {
+ if (ap_ctrl_iface_chanswitch(wpa_s, buf + 12))
+ reply_len = -1;
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -26,6 +26,7 @@
+ #include "taxonomy.h"
+ #include "wnm_ap.h"
+
++#ifdef CONFIG_CTRL_IFACE_MIB
+
+ static size_t hostapd_write_ht_mcs_bitmask(char *buf, size_t buflen,
+ size_t curr_len, const u8 *mcs_set)
+@@ -460,6 +461,7 @@ int hostapd_ctrl_iface_sta_next(struct h
+ return hostapd_ctrl_iface_sta_mib(hapd, sta->next, buf, buflen);
+ }
+
++#endif
+
+ #ifdef CONFIG_P2P_MANAGER
+ static int p2p_manager_disconnect(struct hostapd_data *hapd, u16 stype,
+@@ -832,12 +834,12 @@ int hostapd_ctrl_iface_status(struct hos
+ return len;
+ len += ret;
+ }
+-
++#ifdef CONFIG_CTRL_IFACE_MIB
+ if (iface->conf->ieee80211n && !hapd->conf->disable_11n && mode) {
+ len = hostapd_write_ht_mcs_bitmask(buf, buflen, len,
+ mode->mcs_set);
+ }
+-
++#endif /* CONFIG_CTRL_IFACE_MIB */
+ if (iface->current_rates && iface->num_rates) {
+ ret = os_snprintf(buf + len, buflen - len, "supported_rates=");
+ if (os_snprintf_error(buflen - len, ret))
+--- a/src/ap/ieee802_1x.c
++++ b/src/ap/ieee802_1x.c
+@@ -2740,6 +2740,7 @@ static const char * bool_txt(bool val)
+ return val ? "TRUE" : "FALSE";
+ }
+
++#ifdef CONFIG_CTRL_IFACE_MIB
+
+ int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
+ {
+@@ -2926,6 +2927,7 @@ int ieee802_1x_get_mib_sta(struct hostap
+ return len;
+ }
+
++#endif
+
+ #ifdef CONFIG_HS20
+ static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx)
+--- a/src/ap/wpa_auth.c
++++ b/src/ap/wpa_auth.c
+@@ -4559,6 +4559,7 @@ static const char * wpa_bool_txt(int val
+ return val ? "TRUE" : "FALSE";
+ }
+
++#ifdef CONFIG_CTRL_IFACE_MIB
+
+ #define RSN_SUITE "%02x-%02x-%02x-%d"
+ #define RSN_SUITE_ARG(s) \
+@@ -4709,7 +4710,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
+
+ return len;
+ }
+-
++#endif
+
+ void wpa_auth_countermeasures_start(struct wpa_authenticator *wpa_auth)
+ {
+--- a/src/rsn_supp/wpa.c
++++ b/src/rsn_supp/wpa.c
+@@ -2802,6 +2802,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
+ }
+
+
++#ifdef CONFIG_CTRL_IFACE_MIB
++
+ #define RSN_SUITE "%02x-%02x-%02x-%d"
+ #define RSN_SUITE_ARG(s) \
+ ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
+@@ -2883,6 +2885,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
+
+ return (int) len;
+ }
++#endif
+ #endif /* CONFIG_CTRL_IFACE */
+
+
+--- a/wpa_supplicant/ap.c
++++ b/wpa_supplicant/ap.c
+@@ -1477,7 +1477,7 @@ int wpas_ap_wps_nfc_report_handover(stru
+ #endif /* CONFIG_WPS */
+
+
+-#ifdef CONFIG_CTRL_IFACE
++#if defined(CONFIG_CTRL_IFACE) && defined(CONFIG_CTRL_IFACE_MIB)
+
+ int ap_ctrl_iface_sta_first(struct wpa_supplicant *wpa_s,
+ char *buf, size_t buflen)
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/381-hostapd_cli_UNKNOWN-COMMAND.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/381-hostapd_cli_UNKNOWN-COMMAND.patch
new file mode 100644
index 0000000..d2414fa
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/381-hostapd_cli_UNKNOWN-COMMAND.patch
@@ -0,0 +1,11 @@
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -744,7 +744,7 @@ static int wpa_ctrl_command_sta(struct w
+ }
+
+ buf[len] = '\0';
+- if (memcmp(buf, "FAIL", 4) == 0)
++ if (memcmp(buf, "FAIL", 4) == 0 || memcmp(buf, "UNKNOWN COMMAND", 15) == 0)
+ return -1;
+ if (print)
+ printf("%s", buf);
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/390-wpa_ie_cap_workaround.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/390-wpa_ie_cap_workaround.patch
new file mode 100644
index 0000000..bf481c3
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/390-wpa_ie_cap_workaround.patch
@@ -0,0 +1,56 @@
+--- a/src/common/wpa_common.c
++++ b/src/common/wpa_common.c
+@@ -2529,6 +2529,31 @@ u32 wpa_akm_to_suite(int akm)
+ }
+
+
++static void wpa_fixup_wpa_ie_rsn(u8 *assoc_ie, const u8 *wpa_msg_ie,
++ size_t rsn_ie_len)
++{
++ int pos, count;
++
++ pos = sizeof(struct rsn_ie_hdr) + RSN_SELECTOR_LEN;
++ if (rsn_ie_len < pos + 2)
++ return;
++
++ count = WPA_GET_LE16(wpa_msg_ie + pos);
++ pos += 2 + count * RSN_SELECTOR_LEN;
++ if (rsn_ie_len < pos + 2)
++ return;
++
++ count = WPA_GET_LE16(wpa_msg_ie + pos);
++ pos += 2 + count * RSN_SELECTOR_LEN;
++ if (rsn_ie_len < pos + 2)
++ return;
++
++ if (!assoc_ie[pos] && !assoc_ie[pos + 1] &&
++ (wpa_msg_ie[pos] || wpa_msg_ie[pos + 1]))
++ memcpy(&assoc_ie[pos], &wpa_msg_ie[pos], 2);
++}
++
++
+ int wpa_compare_rsn_ie(int ft_initial_assoc,
+ const u8 *ie1, size_t ie1len,
+ const u8 *ie2, size_t ie2len)
+@@ -2536,8 +2561,19 @@ int wpa_compare_rsn_ie(int ft_initial_as
+ if (ie1 == NULL || ie2 == NULL)
+ return -1;
+
+- if (ie1len == ie2len && os_memcmp(ie1, ie2, ie1len) == 0)
+- return 0; /* identical IEs */
++ if (ie1len == ie2len) {
++ u8 *ie_tmp;
++
++ if (os_memcmp(ie1, ie2, ie1len) == 0)
++ return 0; /* identical IEs */
++
++ ie_tmp = alloca(ie1len);
++ memcpy(ie_tmp, ie1, ie1len);
++ wpa_fixup_wpa_ie_rsn(ie_tmp, ie2, ie1len);
++
++ if (os_memcmp(ie_tmp, ie2, ie1len) == 0)
++ return 0; /* only mismatch in RSN capabilties */
++ }
+
+ #ifdef CONFIG_IEEE80211R
+ if (ft_initial_assoc) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/400-wps_single_auth_enc_type.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/400-wps_single_auth_enc_type.patch
new file mode 100644
index 0000000..edcd985
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/400-wps_single_auth_enc_type.patch
@@ -0,0 +1,23 @@
+--- a/src/ap/wps_hostapd.c
++++ b/src/ap/wps_hostapd.c
+@@ -394,9 +394,8 @@ static int hapd_wps_reconfig_in_memory(s
+ bss->wpa_pairwise |= WPA_CIPHER_GCMP;
+ else
+ bss->wpa_pairwise |= WPA_CIPHER_CCMP;
+- }
+ #ifndef CONFIG_NO_TKIP
+- if (cred->encr_type & WPS_ENCR_TKIP)
++ } else if (cred->encr_type & WPS_ENCR_TKIP)
+ bss->wpa_pairwise |= WPA_CIPHER_TKIP;
+ #endif /* CONFIG_NO_TKIP */
+ bss->rsn_pairwise = bss->wpa_pairwise;
+@@ -1181,8 +1180,7 @@ int hostapd_init_wps(struct hostapd_data
+ WPA_CIPHER_GCMP_256)) {
+ wps->encr_types |= WPS_ENCR_AES;
+ wps->encr_types_rsn |= WPS_ENCR_AES;
+- }
+- if (conf->rsn_pairwise & WPA_CIPHER_TKIP) {
++ } else if (conf->rsn_pairwise & WPA_CIPHER_TKIP) {
+ #ifdef CONFIG_NO_TKIP
+ wpa_printf(MSG_INFO, "WPS: TKIP not supported");
+ goto fail;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/410-limit_debug_messages.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/410-limit_debug_messages.patch
new file mode 100644
index 0000000..d2713fc
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/410-limit_debug_messages.patch
@@ -0,0 +1,210 @@
+--- a/src/utils/wpa_debug.c
++++ b/src/utils/wpa_debug.c
+@@ -206,7 +206,7 @@ void wpa_debug_close_linux_tracing(void)
+ *
+ * Note: New line '\n' is added to the end of the text when printing to stdout.
+ */
+-void wpa_printf(int level, const char *fmt, ...)
++void _wpa_printf(int level, const char *fmt, ...)
+ {
+ va_list ap;
+
+@@ -255,7 +255,7 @@ void wpa_printf(int level, const char *f
+ }
+
+
+-static void _wpa_hexdump(int level, const char *title, const u8 *buf,
++void _wpa_hexdump(int level, const char *title, const u8 *buf,
+ size_t len, int show, int only_syslog)
+ {
+ size_t i;
+@@ -382,19 +382,7 @@ static void _wpa_hexdump(int level, cons
+ #endif /* CONFIG_ANDROID_LOG */
+ }
+
+-void wpa_hexdump(int level, const char *title, const void *buf, size_t len)
+-{
+- _wpa_hexdump(level, title, buf, len, 1, 0);
+-}
+-
+-
+-void wpa_hexdump_key(int level, const char *title, const void *buf, size_t len)
+-{
+- _wpa_hexdump(level, title, buf, len, wpa_debug_show_keys, 0);
+-}
+-
+-
+-static void _wpa_hexdump_ascii(int level, const char *title, const void *buf,
++void _wpa_hexdump_ascii(int level, const char *title, const void *buf,
+ size_t len, int show)
+ {
+ size_t i, llen;
+@@ -507,20 +495,6 @@ file_done:
+ }
+
+
+-void wpa_hexdump_ascii(int level, const char *title, const void *buf,
+- size_t len)
+-{
+- _wpa_hexdump_ascii(level, title, buf, len, 1);
+-}
+-
+-
+-void wpa_hexdump_ascii_key(int level, const char *title, const void *buf,
+- size_t len)
+-{
+- _wpa_hexdump_ascii(level, title, buf, len, wpa_debug_show_keys);
+-}
+-
+-
+ #ifdef CONFIG_DEBUG_FILE
+ static char *last_path = NULL;
+ #endif /* CONFIG_DEBUG_FILE */
+@@ -636,7 +610,7 @@ void wpa_msg_register_ifname_cb(wpa_msg_
+ }
+
+
+-void wpa_msg(void *ctx, int level, const char *fmt, ...)
++void _wpa_msg(void *ctx, int level, const char *fmt, ...)
+ {
+ va_list ap;
+ char *buf;
+@@ -674,7 +648,7 @@ void wpa_msg(void *ctx, int level, const
+ }
+
+
+-void wpa_msg_ctrl(void *ctx, int level, const char *fmt, ...)
++void _wpa_msg_ctrl(void *ctx, int level, const char *fmt, ...)
+ {
+ va_list ap;
+ char *buf;
+--- a/src/utils/wpa_debug.h
++++ b/src/utils/wpa_debug.h
+@@ -50,6 +50,17 @@ int wpa_debug_reopen_file(void);
+ void wpa_debug_close_file(void);
+ void wpa_debug_setup_stdout(void);
+
++/* internal */
++void _wpa_hexdump(int level, const char *title, const u8 *buf,
++ size_t len, int show, int only_syslog);
++void _wpa_hexdump_ascii(int level, const char *title, const void *buf,
++ size_t len, int show);
++extern int wpa_debug_show_keys;
++
++#ifndef CONFIG_MSG_MIN_PRIORITY
++#define CONFIG_MSG_MIN_PRIORITY 0
++#endif
++
+ /**
+ * wpa_debug_printf_timestamp - Print timestamp for debug output
+ *
+@@ -70,9 +81,15 @@ void wpa_debug_print_timestamp(void);
+ *
+ * Note: New line '\n' is added to the end of the text when printing to stdout.
+ */
+-void wpa_printf(int level, const char *fmt, ...)
++void _wpa_printf(int level, const char *fmt, ...)
+ PRINTF_FORMAT(2, 3);
+
++#define wpa_printf(level, ...) \
++ do { \
++ if (level >= CONFIG_MSG_MIN_PRIORITY) \
++ _wpa_printf(level, __VA_ARGS__); \
++ } while(0)
++
+ /**
+ * wpa_hexdump - conditional hex dump
+ * @level: priority level (MSG_*) of the message
+@@ -84,7 +101,13 @@ PRINTF_FORMAT(2, 3);
+ * output may be directed to stdout, stderr, and/or syslog based on
+ * configuration. The contents of buf is printed out has hex dump.
+ */
+-void wpa_hexdump(int level, const char *title, const void *buf, size_t len);
++static inline void wpa_hexdump(int level, const char *title, const void *buf, size_t len)
++{
++ if (level < CONFIG_MSG_MIN_PRIORITY)
++ return;
++
++ _wpa_hexdump(level, title, buf, len, 1, 1);
++}
+
+ static inline void wpa_hexdump_buf(int level, const char *title,
+ const struct wpabuf *buf)
+@@ -106,7 +129,13 @@ static inline void wpa_hexdump_buf(int l
+ * like wpa_hexdump(), but by default, does not include secret keys (passwords,
+ * etc.) in debug output.
+ */
+-void wpa_hexdump_key(int level, const char *title, const void *buf, size_t len);
++static inline void wpa_hexdump_key(int level, const char *title, const u8 *buf, size_t len)
++{
++ if (level < CONFIG_MSG_MIN_PRIORITY)
++ return;
++
++ _wpa_hexdump(level, title, buf, len, wpa_debug_show_keys, 1);
++}
+
+ static inline void wpa_hexdump_buf_key(int level, const char *title,
+ const struct wpabuf *buf)
+@@ -128,8 +157,14 @@ static inline void wpa_hexdump_buf_key(i
+ * the hex numbers and ASCII characters (for printable range) are shown. 16
+ * bytes per line will be shown.
+ */
+-void wpa_hexdump_ascii(int level, const char *title, const void *buf,
+- size_t len);
++static inline void wpa_hexdump_ascii(int level, const char *title,
++ const u8 *buf, size_t len)
++{
++ if (level < CONFIG_MSG_MIN_PRIORITY)
++ return;
++
++ _wpa_hexdump_ascii(level, title, buf, len, 1);
++}
+
+ /**
+ * wpa_hexdump_ascii_key - conditional hex dump, hide keys
+@@ -145,8 +180,14 @@ void wpa_hexdump_ascii(int level, const
+ * bytes per line will be shown. This works like wpa_hexdump_ascii(), but by
+ * default, does not include secret keys (passwords, etc.) in debug output.
+ */
+-void wpa_hexdump_ascii_key(int level, const char *title, const void *buf,
+- size_t len);
++static inline void wpa_hexdump_ascii_key(int level, const char *title,
++ const u8 *buf, size_t len)
++{
++ if (level < CONFIG_MSG_MIN_PRIORITY)
++ return;
++
++ _wpa_hexdump_ascii(level, title, buf, len, wpa_debug_show_keys);
++}
+
+ /*
+ * wpa_dbg() behaves like wpa_msg(), but it can be removed from build to reduce
+@@ -183,7 +224,12 @@ void wpa_hexdump_ascii_key(int level, co
+ *
+ * Note: New line '\n' is added to the end of the text when printing to stdout.
+ */
+-void wpa_msg(void *ctx, int level, const char *fmt, ...) PRINTF_FORMAT(3, 4);
++void _wpa_msg(void *ctx, int level, const char *fmt, ...) PRINTF_FORMAT(3, 4);
++#define wpa_msg(ctx, level, ...) \
++ do { \
++ if (level >= CONFIG_MSG_MIN_PRIORITY) \
++ _wpa_msg(ctx, level, __VA_ARGS__); \
++ } while(0)
+
+ /**
+ * wpa_msg_ctrl - Conditional printf for ctrl_iface monitors
+@@ -197,8 +243,13 @@ void wpa_msg(void *ctx, int level, const
+ * attached ctrl_iface monitors. In other words, it can be used for frequent
+ * events that do not need to be sent to syslog.
+ */
+-void wpa_msg_ctrl(void *ctx, int level, const char *fmt, ...)
++void _wpa_msg_ctrl(void *ctx, int level, const char *fmt, ...)
+ PRINTF_FORMAT(3, 4);
++#define wpa_msg_ctrl(ctx, level, ...) \
++ do { \
++ if (level >= CONFIG_MSG_MIN_PRIORITY) \
++ _wpa_msg_ctrl(ctx, level, __VA_ARGS__); \
++ } while(0)
+
+ /**
+ * wpa_msg_global - Global printf for ctrl_iface monitors
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/420-indicate-features.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/420-indicate-features.patch
new file mode 100644
index 0000000..12edb6b
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/420-indicate-features.patch
@@ -0,0 +1,63 @@
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -31,7 +31,7 @@
+ #include "config_file.h"
+ #include "eap_register.h"
+ #include "ctrl_iface.h"
+-
++#include "build_features.h"
+
+ struct hapd_global {
+ void **drv_priv;
+@@ -692,7 +692,7 @@ int main(int argc, char *argv[])
+ wpa_supplicant_event = hostapd_wpa_event;
+ wpa_supplicant_event_global = hostapd_wpa_event_global;
+ for (;;) {
+- c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:q");
++ c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:g:G:qv::");
+ if (c < 0)
+ break;
+ switch (c) {
+@@ -729,6 +729,8 @@ int main(int argc, char *argv[])
+ break;
+ #endif /* CONFIG_DEBUG_LINUX_TRACING */
+ case 'v':
++ if (optarg)
++ exit(!has_feature(optarg));
+ show_version();
+ exit(1);
+ case 'g':
+--- a/wpa_supplicant/main.c
++++ b/wpa_supplicant/main.c
+@@ -12,6 +12,7 @@
+ #endif /* __linux__ */
+
+ #include "common.h"
++#include "build_features.h"
+ #include "crypto/crypto.h"
+ #include "fst/fst.h"
+ #include "wpa_supplicant_i.h"
+@@ -203,7 +204,7 @@ int main(int argc, char *argv[])
+
+ for (;;) {
+ c = getopt(argc, argv,
+- "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuvW");
++ "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuv::W");
+ if (c < 0)
+ break;
+ switch (c) {
+@@ -306,8 +307,12 @@ int main(int argc, char *argv[])
+ break;
+ #endif /* CONFIG_CTRL_IFACE_DBUS_NEW */
+ case 'v':
+- printf("%s\n", wpa_supplicant_version);
+- exitcode = 0;
++ if (optarg) {
++ exitcode = !has_feature(optarg);
++ } else {
++ printf("%s\n", wpa_supplicant_version);
++ exitcode = 0;
++ }
+ goto out;
+ case 'W':
+ params.wait_for_monitor++;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/430-hostapd_cli_ifdef.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/430-hostapd_cli_ifdef.patch
new file mode 100644
index 0000000..e524209
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/430-hostapd_cli_ifdef.patch
@@ -0,0 +1,56 @@
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -388,7 +388,6 @@ static int hostapd_cli_cmd_disassociate(
+ }
+
+
+-#ifdef CONFIG_TAXONOMY
+ static int hostapd_cli_cmd_signature(struct wpa_ctrl *ctrl, int argc,
+ char *argv[])
+ {
+@@ -401,7 +400,6 @@ static int hostapd_cli_cmd_signature(str
+ os_snprintf(buf, sizeof(buf), "SIGNATURE %s", argv[0]);
+ return wpa_ctrl_command(ctrl, buf);
+ }
+-#endif /* CONFIG_TAXONOMY */
+
+
+ static int hostapd_cli_cmd_sa_query(struct wpa_ctrl *ctrl, int argc,
+@@ -418,7 +416,6 @@ static int hostapd_cli_cmd_sa_query(stru
+ }
+
+
+-#ifdef CONFIG_WPS
+ static int hostapd_cli_cmd_wps_pin(struct wpa_ctrl *ctrl, int argc,
+ char *argv[])
+ {
+@@ -644,7 +641,6 @@ static int hostapd_cli_cmd_wps_config(st
+ ssid_hex, argv[1]);
+ return wpa_ctrl_command(ctrl, buf);
+ }
+-#endif /* CONFIG_WPS */
+
+
+ static int hostapd_cli_cmd_disassoc_imminent(struct wpa_ctrl *ctrl, int argc,
+@@ -1588,13 +1584,10 @@ static const struct hostapd_cli_cmd host
+ { "disassociate", hostapd_cli_cmd_disassociate,
+ hostapd_complete_stations,
+ "<addr> = disassociate a station" },
+-#ifdef CONFIG_TAXONOMY
+ { "signature", hostapd_cli_cmd_signature, hostapd_complete_stations,
+ "<addr> = get taxonomy signature for a station" },
+-#endif /* CONFIG_TAXONOMY */
+ { "sa_query", hostapd_cli_cmd_sa_query, hostapd_complete_stations,
+ "<addr> = send SA Query to a station" },
+-#ifdef CONFIG_WPS
+ { "wps_pin", hostapd_cli_cmd_wps_pin, NULL,
+ "<uuid> <pin> [timeout] [addr] = add WPS Enrollee PIN" },
+ { "wps_check_pin", hostapd_cli_cmd_wps_check_pin, NULL,
+@@ -1619,7 +1612,6 @@ static const struct hostapd_cli_cmd host
+ "<SSID> <auth> <encr> <key> = configure AP" },
+ { "wps_get_status", hostapd_cli_cmd_wps_get_status, NULL,
+ "= show current WPS status" },
+-#endif /* CONFIG_WPS */
+ { "disassoc_imminent", hostapd_cli_cmd_disassoc_imminent, NULL,
+ "= send Disassociation Imminent notification" },
+ { "ess_disassoc", hostapd_cli_cmd_ess_disassoc, NULL,
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/431-wpa_cli_ifdef.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/431-wpa_cli_ifdef.patch
new file mode 100644
index 0000000..65c31c5
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/431-wpa_cli_ifdef.patch
@@ -0,0 +1,18 @@
+--- a/wpa_supplicant/wpa_cli.c
++++ b/wpa_supplicant/wpa_cli.c
+@@ -26,6 +26,15 @@
+ #include <cutils/properties.h>
+ #endif /* ANDROID */
+
++#ifndef CONFIG_P2P
++#define CONFIG_P2P
++#endif
++#ifndef CONFIG_AP
++#define CONFIG_AP
++#endif
++#ifndef CONFIG_MESH
++#define CONFIG_MESH
++#endif
+
+ static const char *const wpa_cli_version =
+ "wpa_cli v" VERSION_STR "\n"
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/432-missing-typedef.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/432-missing-typedef.patch
new file mode 100644
index 0000000..7a100f1
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/432-missing-typedef.patch
@@ -0,0 +1,10 @@
+--- a/src/drivers/linux_wext.h
++++ b/src/drivers/linux_wext.h
+@@ -26,6 +26,7 @@ typedef int32_t __s32;
+ typedef uint16_t __u16;
+ typedef int16_t __s16;
+ typedef uint8_t __u8;
++typedef int8_t __s8;
+ #ifndef __user
+ #define __user
+ #endif /* __user */
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/450-scan_wait.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/450-scan_wait.patch
new file mode 100644
index 0000000..ac874ad
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/450-scan_wait.patch
@@ -0,0 +1,73 @@
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -39,6 +39,8 @@ struct hapd_global {
+ };
+
+ static struct hapd_global global;
++static int daemonize = 0;
++static char *pid_file = NULL;
+
+
+ #ifndef CONFIG_NO_HOSTAPD_LOGGER
+@@ -146,6 +148,14 @@ static void hostapd_logger_cb(void *ctx,
+ }
+ #endif /* CONFIG_NO_HOSTAPD_LOGGER */
+
++static void hostapd_setup_complete_cb(void *ctx)
++{
++ if (daemonize && os_daemonize(pid_file)) {
++ perror("daemon");
++ return;
++ }
++ daemonize = 0;
++}
+
+ /**
+ * hostapd_driver_init - Preparate driver interface
+@@ -164,6 +174,8 @@ static int hostapd_driver_init(struct ho
+ return -1;
+ }
+
++ hapd->setup_complete_cb = hostapd_setup_complete_cb;
++
+ /* Initialize the driver interface */
+ if (!(b[0] | b[1] | b[2] | b[3] | b[4] | b[5]))
+ b = NULL;
+@@ -404,8 +416,6 @@ static void hostapd_global_deinit(const
+ #endif /* CONFIG_NATIVE_WINDOWS */
+
+ eap_server_unregister_methods();
+-
+- os_daemonize_terminate(pid_file);
+ }
+
+
+@@ -431,18 +441,6 @@ static int hostapd_global_run(struct hap
+ }
+ #endif /* EAP_SERVER_TNC */
+
+- if (daemonize) {
+- if (os_daemonize(pid_file)) {
+- wpa_printf(MSG_ERROR, "daemon: %s", strerror(errno));
+- return -1;
+- }
+- if (eloop_sock_requeue()) {
+- wpa_printf(MSG_ERROR, "eloop_sock_requeue: %s",
+- strerror(errno));
+- return -1;
+- }
+- }
+-
+ eloop_run();
+
+ return 0;
+@@ -645,8 +643,7 @@ int main(int argc, char *argv[])
+ struct hapd_interfaces interfaces;
+ int ret = 1;
+ size_t i, j;
+- int c, debug = 0, daemonize = 0;
+- char *pid_file = NULL;
++ int c, debug = 0;
+ const char *log_file = NULL;
+ const char *entropy_file = NULL;
+ char **bss_config = NULL, **tmp_bss;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
new file mode 100644
index 0000000..38ff663
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
@@ -0,0 +1,189 @@
+From 4bb69d15477e0f2b00e166845341dc933de47c58 Mon Sep 17 00:00:00 2001
+From: Antonio Quartulli <ordex@autistici.org>
+Date: Sun, 3 Jun 2012 18:22:56 +0200
+Subject: [PATCHv2 601/602] wpa_supplicant: add new config params to be used
+ with the ibss join command
+
+Signed-hostap: Antonio Quartulli <ordex@autistici.org>
+---
+ src/drivers/driver.h | 6 +++
+ wpa_supplicant/config.c | 96 +++++++++++++++++++++++++++++++++++++++
+ wpa_supplicant/config_ssid.h | 6 +++
+ wpa_supplicant/wpa_supplicant.c | 23 +++++++---
+ 4 files changed, 124 insertions(+), 7 deletions(-)
+
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -19,6 +19,7 @@
+
+ #define WPA_SUPPLICANT_DRIVER_VERSION 4
+
++#include "ap/sta_info.h"
+ #include "common/defs.h"
+ #include "common/ieee802_11_defs.h"
+ #include "common/wpa_common.h"
+@@ -894,6 +895,9 @@ struct wpa_driver_associate_params {
+ * responsible for selecting with which BSS to associate. */
+ const u8 *bssid;
+
++ unsigned char rates[WLAN_SUPP_RATES_MAX];
++ int mcast_rate;
++
+ /**
+ * bssid_hint - BSSID of a proposed AP
+ *
+--- a/wpa_supplicant/config.c
++++ b/wpa_supplicant/config.c
+@@ -18,6 +18,7 @@
+ #include "eap_peer/eap.h"
+ #include "p2p/p2p.h"
+ #include "fst/fst.h"
++#include "ap/sta_info.h"
+ #include "config.h"
+
+
+@@ -2345,6 +2346,97 @@ static char * wpa_config_write_peerkey(c
+ #endif /* NO_CONFIG_WRITE */
+
+
++static int wpa_config_parse_mcast_rate(const struct parse_data *data,
++ struct wpa_ssid *ssid, int line,
++ const char *value)
++{
++ ssid->mcast_rate = (int)(strtod(value, NULL) * 10);
++
++ return 0;
++}
++
++#ifndef NO_CONFIG_WRITE
++static char * wpa_config_write_mcast_rate(const struct parse_data *data,
++ struct wpa_ssid *ssid)
++{
++ char *value;
++ int res;
++
++ if (!ssid->mcast_rate == 0)
++ return NULL;
++
++ value = os_malloc(6); /* longest: 300.0 */
++ if (value == NULL)
++ return NULL;
++ res = os_snprintf(value, 5, "%.1f", (double)ssid->mcast_rate / 10);
++ if (res < 0) {
++ os_free(value);
++ return NULL;
++ }
++ return value;
++}
++#endif /* NO_CONFIG_WRITE */
++
++static int wpa_config_parse_rates(const struct parse_data *data,
++ struct wpa_ssid *ssid, int line,
++ const char *value)
++{
++ int i;
++ char *pos, *r, *sptr, *end;
++ double rate;
++
++ pos = (char *)value;
++ r = strtok_r(pos, ",", &sptr);
++ i = 0;
++ while (pos && i < WLAN_SUPP_RATES_MAX) {
++ rate = 0.0;
++ if (r)
++ rate = strtod(r, &end);
++ ssid->rates[i] = rate * 2;
++ if (*end != '\0' || rate * 2 != ssid->rates[i])
++ return 1;
++
++ i++;
++ r = strtok_r(NULL, ",", &sptr);
++ }
++
++ return 0;
++}
++
++#ifndef NO_CONFIG_WRITE
++static char * wpa_config_write_rates(const struct parse_data *data,
++ struct wpa_ssid *ssid)
++{
++ char *value, *pos;
++ int res, i;
++
++ if (ssid->rates[0] <= 0)
++ return NULL;
++
++ value = os_malloc(6 * WLAN_SUPP_RATES_MAX + 1);
++ if (value == NULL)
++ return NULL;
++ pos = value;
++ for (i = 0; i < WLAN_SUPP_RATES_MAX - 1; i++) {
++ res = os_snprintf(pos, 6, "%.1f,", (double)ssid->rates[i] / 2);
++ if (res < 0) {
++ os_free(value);
++ return NULL;
++ }
++ pos += res;
++ }
++ res = os_snprintf(pos, 6, "%.1f",
++ (double)ssid->rates[WLAN_SUPP_RATES_MAX - 1] / 2);
++ if (res < 0) {
++ os_free(value);
++ return NULL;
++ }
++
++ value[6 * WLAN_SUPP_RATES_MAX] = '\0';
++ return value;
++}
++#endif /* NO_CONFIG_WRITE */
++
+ /* Helper macros for network block parser */
+
+ #ifdef OFFSET
+@@ -2629,6 +2721,8 @@ static const struct parse_data ssid_fiel
+ { INT(ap_max_inactivity) },
+ { INT(dtim_period) },
+ { INT(beacon_int) },
++ { FUNC(rates) },
++ { FUNC(mcast_rate) },
+ #ifdef CONFIG_MACSEC
+ { INT_RANGE(macsec_policy, 0, 1) },
+ { INT_RANGE(macsec_integ_only, 0, 1) },
+--- a/wpa_supplicant/config_ssid.h
++++ b/wpa_supplicant/config_ssid.h
+@@ -10,8 +10,10 @@
+ #define CONFIG_SSID_H
+
+ #include "common/defs.h"
++#include "ap/sta_info.h"
+ #include "utils/list.h"
+ #include "eap_peer/eap_config.h"
++#include "drivers/nl80211_copy.h"
+
+
+ #define DEFAULT_EAP_WORKAROUND ((unsigned int) -1)
+@@ -846,6 +848,9 @@ struct wpa_ssid {
+ */
+ void *parent_cred;
+
++ unsigned char rates[WLAN_SUPP_RATES_MAX];
++ double mcast_rate;
++
+ #ifdef CONFIG_MACSEC
+ /**
+ * macsec_policy - Determines the policy for MACsec secure session
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -3899,6 +3899,12 @@ static void wpas_start_assoc_cb(struct w
+ params.beacon_int = ssid->beacon_int;
+ else
+ params.beacon_int = wpa_s->conf->beacon_int;
++ int i = 0;
++ while (i < WLAN_SUPP_RATES_MAX) {
++ params.rates[i] = ssid->rates[i];
++ i++;
++ }
++ params.mcast_rate = ssid->mcast_rate;
+ }
+
+ if (bss && ssid->enable_edmg)
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/461-driver_nl80211-use-new-parameters-during-ibss-join.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/461-driver_nl80211-use-new-parameters-during-ibss-join.patch
new file mode 100644
index 0000000..65d67b8
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/461-driver_nl80211-use-new-parameters-during-ibss-join.patch
@@ -0,0 +1,59 @@
+From ffc4445958a3ed4064f2e1bf73fa478a61c5cf7b Mon Sep 17 00:00:00 2001
+From: Antonio Quartulli <ordex@autistici.org>
+Date: Sun, 3 Jun 2012 18:42:25 +0200
+Subject: [PATCHv2 602/602] driver_nl80211: use new parameters during ibss join
+
+Signed-hostap: Antonio Quartulli <ordex@autistici.org>
+---
+ src/drivers/driver_nl80211.c | 33 ++++++++++++++++++++++++++++++++-
+ 1 file changed, 32 insertions(+), 1 deletion(-)
+
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -6005,7 +6005,7 @@ static int wpa_driver_nl80211_ibss(struc
+ struct wpa_driver_associate_params *params)
+ {
+ struct nl_msg *msg;
+- int ret = -1;
++ int ret = -1, i;
+ int count = 0;
+
+ wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
+@@ -6032,6 +6032,37 @@ retry:
+ nl80211_put_beacon_int(msg, params->beacon_int))
+ goto fail;
+
++ if (params->fixed_freq) {
++ wpa_printf(MSG_DEBUG, " * fixed_freq");
++ nla_put_flag(msg, NL80211_ATTR_FREQ_FIXED);
++ }
++
++ if (params->beacon_int > 0) {
++ wpa_printf(MSG_DEBUG, " * beacon_int=%d",
++ params->beacon_int);
++ nla_put_u32(msg, NL80211_ATTR_BEACON_INTERVAL,
++ params->beacon_int);
++ }
++
++ if (params->rates[0] > 0) {
++ wpa_printf(MSG_DEBUG, " * basic_rates:");
++ i = 0;
++ while (i < NL80211_MAX_SUPP_RATES &&
++ params->rates[i] > 0) {
++ wpa_printf(MSG_DEBUG, " %.1f",
++ (double)params->rates[i] / 2);
++ i++;
++ }
++ nla_put(msg, NL80211_ATTR_BSS_BASIC_RATES, i,
++ params->rates);
++ }
++
++ if (params->mcast_rate > 0) {
++ wpa_printf(MSG_DEBUG, " * mcast_rate=%.1f",
++ (double)params->mcast_rate / 10);
++ nla_put_u32(msg, NL80211_ATTR_MCAST_RATE, params->mcast_rate);
++ }
++
+ ret = nl80211_set_conn_keys(params, msg);
+ if (ret)
+ goto fail;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/463-add-mcast_rate-to-11s.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/463-add-mcast_rate-to-11s.patch
new file mode 100644
index 0000000..5dc19fe
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/463-add-mcast_rate-to-11s.patch
@@ -0,0 +1,68 @@
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Thu, 11 May 2017 08:21:45 +0200
+Subject: [PATCH] set mcast_rate in mesh mode
+
+The wpa_supplicant code for IBSS allows to set the mcast rate. It is
+recommended to increase this value from 1 or 6 Mbit/s to something higher
+when using a mesh protocol on top which uses the multicast packet loss as
+indicator for the link quality.
+
+This setting was unfortunately not applied for mesh mode. But it would be
+beneficial when wpa_supplicant would behave similar to IBSS mode and set
+this argument during mesh join like authsae already does. At least it is
+helpful for companies/projects which are currently switching to 802.11s
+(without mesh_fwding and with mesh_ttl set to 1) as replacement for IBSS
+because newer drivers seem to support 802.11s but not IBSS anymore.
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
+
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1661,6 +1661,7 @@ struct wpa_driver_mesh_join_params {
+ #define WPA_DRIVER_MESH_FLAG_AMPE 0x00000008
+ unsigned int flags;
+ bool handle_dfs;
++ int mcast_rate;
+ };
+
+ struct wpa_driver_set_key_params {
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -10627,6 +10627,18 @@ static int nl80211_put_mesh_id(struct nl
+ }
+
+
++static int nl80211_put_mcast_rate(struct nl_msg *msg, int mcast_rate)
++{
++ if (mcast_rate > 0) {
++ wpa_printf(MSG_DEBUG, " * mcast_rate=%.1f",
++ (double)mcast_rate / 10);
++ return nla_put_u32(msg, NL80211_ATTR_MCAST_RATE, mcast_rate);
++ }
++
++ return 0;
++}
++
++
+ static int nl80211_put_mesh_config(struct nl_msg *msg,
+ struct wpa_driver_mesh_bss_params *params)
+ {
+@@ -10688,6 +10700,7 @@ static int nl80211_join_mesh(struct i802
+ nl80211_put_basic_rates(msg, params->basic_rates) ||
+ nl80211_put_mesh_id(msg, params->meshid, params->meshid_len) ||
+ nl80211_put_beacon_int(msg, params->beacon_int) ||
++ nl80211_put_mcast_rate(msg, params->mcast_rate) ||
+ nl80211_put_dtim_period(msg, params->dtim_period))
+ goto fail;
+
+--- a/wpa_supplicant/mesh.c
++++ b/wpa_supplicant/mesh.c
+@@ -632,6 +632,7 @@ int wpa_supplicant_join_mesh(struct wpa_
+
+ params->meshid = ssid->ssid;
+ params->meshid_len = ssid->ssid_len;
++ params->mcast_rate = ssid->mcast_rate;
+ ibss_mesh_setup_freq(wpa_s, ssid, ¶ms->freq);
+ wpa_s->mesh_ht_enabled = !!params->freq.ht_enabled;
+ wpa_s->mesh_vht_enabled = !!params->freq.vht_enabled;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/464-fix-mesh-obss-check.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/464-fix-mesh-obss-check.patch
new file mode 100644
index 0000000..48086ea
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/464-fix-mesh-obss-check.patch
@@ -0,0 +1,19 @@
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -2539,11 +2539,13 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ for (j = 0; j < wpa_s->last_scan_res_used; j++) {
+ struct wpa_bss *bss = wpa_s->last_scan_res[j];
+
+- if (ssid->mode != WPAS_MODE_IBSS)
++ /* Don't adjust control freq in case of fixed_freq */
++ if (ssid->fixed_freq) {
++ obss_scan = 0;
+ break;
++ }
+
+- /* Don't adjust control freq in case of fixed_freq */
+- if (ssid->fixed_freq)
++ if (ssid->mode != WPAS_MODE_IBSS)
+ break;
+
+ if (!bss_is_ibss(bss))
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/465-hostapd-config-support-random-BSS-color.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/465-hostapd-config-support-random-BSS-color.patch
new file mode 100644
index 0000000..6810b79
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/465-hostapd-config-support-random-BSS-color.patch
@@ -0,0 +1,24 @@
+From c9304d3303d563ad6d2619f4e07864ed12f96889 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 14 May 2022 21:41:03 +0200
+Subject: [PATCH] hostapd: config: support random BSS color
+
+Configure the HE BSS color to a random value in case the config defines
+a BSS color which exceeds the max BSS color (63).
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ hostapd/config_file.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3489,6 +3489,8 @@ static int hostapd_config_fill(struct ho
+ } else if (os_strcmp(buf, "he_bss_color") == 0) {
+ conf->he_op.he_bss_color = atoi(pos) & 0x3f;
+ conf->he_op.he_bss_color_disabled = 0;
++ if (atoi(pos) > 63)
++ conf->he_op.he_bss_color = os_random() % 63 + 1;
+ } else if (os_strcmp(buf, "he_bss_color_partial") == 0) {
+ conf->he_op.he_bss_color_partial = atoi(pos);
+ } else if (os_strcmp(buf, "he_default_pe_duration") == 0) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/470-survey_data_fallback.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/470-survey_data_fallback.patch
new file mode 100644
index 0000000..359b5f3
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/470-survey_data_fallback.patch
@@ -0,0 +1,25 @@
+--- a/src/ap/acs.c
++++ b/src/ap/acs.c
+@@ -420,20 +420,19 @@ static int acs_usable_bw160_chan(const s
+ static int acs_survey_is_sufficient(struct freq_survey *survey)
+ {
+ if (!(survey->filled & SURVEY_HAS_NF)) {
++ survey->nf = -95;
+ wpa_printf(MSG_INFO, "ACS: Survey is missing noise floor");
+- return 0;
+ }
+
+ if (!(survey->filled & SURVEY_HAS_CHAN_TIME)) {
++ survey->channel_time = 0;
+ wpa_printf(MSG_INFO, "ACS: Survey is missing channel time");
+- return 0;
+ }
+
+ if (!(survey->filled & SURVEY_HAS_CHAN_TIME_BUSY) &&
+ !(survey->filled & SURVEY_HAS_CHAN_TIME_RX)) {
+ wpa_printf(MSG_INFO,
+ "ACS: Survey is missing RX and busy time (at least one is required)");
+- return 0;
+ }
+
+ return 1;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/500-lto-jobserver-support.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/500-lto-jobserver-support.patch
new file mode 100644
index 0000000..e0458b2
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/500-lto-jobserver-support.patch
@@ -0,0 +1,59 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -1307,7 +1307,7 @@ hostapd_multi.a: $(BCHECK) $(OBJS)
+ @$(AR) cr $@ hostapd_multi.o $(OBJS)
+
+ hostapd: $(OBJS)
+- $(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
++ +$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
+ @$(E) " LD " $@
+
+ ifdef CONFIG_WPA_TRACE
+@@ -1318,7 +1318,7 @@ _OBJS_VAR := OBJS_c
+ include ../src/objs.mk
+
+ hostapd_cli: $(OBJS_c)
+- $(Q)$(CC) $(LDFLAGS) -o hostapd_cli $(OBJS_c) $(LIBS_c)
++ +$(Q)$(CC) $(LDFLAGS) -o hostapd_cli $(OBJS_c) $(LIBS_c)
+ @$(E) " LD " $@
+
+ NOBJS = nt_password_hash.o ../src/crypto/ms_funcs.o $(SHA1OBJS)
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -1949,31 +1949,31 @@ wpa_supplicant_multi.a: .config $(BCHECK
+ @$(AR) cr $@ wpa_supplicant_multi.o $(OBJS)
+
+ wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
+- $(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
++ +$(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
+ @$(E) " LD " $@
+
+ _OBJS_VAR := OBJS_t
+ include ../src/objs.mk
+ eapol_test: $(OBJS_t)
+- $(Q)$(LDO) $(LDFLAGS) -o eapol_test $(OBJS_t) $(LIBS)
++ +$(Q)$(LDO) $(LDFLAGS) -o eapol_test $(OBJS_t) $(LIBS)
+ @$(E) " LD " $@
+
+ _OBJS_VAR := OBJS_t2
+ include ../src/objs.mk
+ preauth_test: $(OBJS_t2)
+- $(Q)$(LDO) $(LDFLAGS) -o preauth_test $(OBJS_t2) $(LIBS)
++ +$(Q)$(LDO) $(LDFLAGS) -o preauth_test $(OBJS_t2) $(LIBS)
+ @$(E) " LD " $@
+
+ _OBJS_VAR := OBJS_p
+ include ../src/objs.mk
+ wpa_passphrase: $(OBJS_p)
+- $(Q)$(LDO) $(LDFLAGS) -o wpa_passphrase $(OBJS_p) $(LIBS_p) $(LIBS)
++ +$(Q)$(LDO) $(LDFLAGS) -o wpa_passphrase $(OBJS_p) $(LIBS_p) $(LIBS)
+ @$(E) " LD " $@
+
+ _OBJS_VAR := OBJS_c
+ include ../src/objs.mk
+ wpa_cli: $(OBJS_c)
+- $(Q)$(LDO) $(LDFLAGS) -o wpa_cli $(OBJS_c) $(LIBS_c)
++ +$(Q)$(LDO) $(LDFLAGS) -o wpa_cli $(OBJS_c) $(LIBS_c)
+ @$(E) " LD " $@
+
+ LIBCTRL += ../src/common/wpa_ctrl.o
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/590-rrm-wnm-statistics.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/590-rrm-wnm-statistics.patch
new file mode 100644
index 0000000..98b8820
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/590-rrm-wnm-statistics.patch
@@ -0,0 +1,92 @@
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -162,6 +162,21 @@ struct hostapd_sae_commit_queue {
+ };
+
+ /**
++ * struct hostapd_openwrt_stats - OpenWrt custom STA/AP statistics
++ */
++struct hostapd_openwrt_stats {
++ struct {
++ u64 neighbor_report_tx;
++ } rrm;
++
++ struct {
++ u64 bss_transition_query_rx;
++ u64 bss_transition_request_tx;
++ u64 bss_transition_response_rx;
++ } wnm;
++};
++
++/**
+ * struct hostapd_data - hostapd per-BSS data structure
+ */
+ struct hostapd_data {
+@@ -175,6 +190,9 @@ struct hostapd_data {
+
+ u8 own_addr[ETH_ALEN];
+
++ /* OpenWrt specific statistics */
++ struct hostapd_openwrt_stats openwrt_stats;
++
+ int num_sta; /* number of entries in sta_list */
+ struct sta_info *sta_list; /* STA info list head */
+ #define STA_HASH_SIZE 256
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -386,6 +386,7 @@ static int ieee802_11_send_bss_trans_mgm
+ mgmt->u.action.u.bss_tm_req.validity_interval = 1;
+ pos = mgmt->u.action.u.bss_tm_req.variable;
+
++ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
+ MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
+ "validity_interval=%u",
+@@ -659,10 +660,12 @@ int ieee802_11_rx_wnm_action_ap(struct h
+
+ switch (action) {
+ case WNM_BSS_TRANS_MGMT_QUERY:
++ hapd->openwrt_stats.wnm.bss_transition_query_rx++;
+ ieee802_11_rx_bss_trans_mgmt_query(hapd, mgmt->sa, payload,
+ plen);
+ return 0;
+ case WNM_BSS_TRANS_MGMT_RESP:
++ hapd->openwrt_stats.wnm.bss_transition_response_rx++;
+ ieee802_11_rx_bss_trans_mgmt_resp(hapd, mgmt->sa, payload,
+ plen);
+ return 0;
+@@ -709,6 +712,7 @@ int wnm_send_disassoc_imminent(struct ho
+
+ pos = mgmt->u.action.u.bss_tm_req.variable;
+
++ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request frame to indicate imminent disassociation (disassoc_timer=%d) to "
+ MACSTR, disassoc_timer, MAC2STR(sta->addr));
+ if (hostapd_drv_send_mlme(hapd, buf, pos - buf, 0, NULL, 0, 0) < 0) {
+@@ -790,6 +794,7 @@ int wnm_send_ess_disassoc_imminent(struc
+ return -1;
+ }
+
++ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ if (disassoc_timer) {
+ /* send disassociation frame after time-out */
+ set_disassoc_timer(hapd, sta, disassoc_timer);
+@@ -870,6 +875,7 @@ int wnm_send_bss_tm_req(struct hostapd_d
+ }
+ os_free(buf);
+
++ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ if (disassoc_timer) {
+ /* send disassociation frame after time-out */
+ set_disassoc_timer(hapd, sta, disassoc_timer);
+--- a/src/ap/rrm.c
++++ b/src/ap/rrm.c
+@@ -269,6 +269,8 @@ static void hostapd_send_nei_report_resp
+ }
+ }
+
++ hapd->openwrt_stats.rrm.neighbor_report_tx++;
++
+ hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr,
+ wpabuf_head(buf), wpabuf_len(buf));
+ wpabuf_free(buf);
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/599-wpa_supplicant-fix-warnings.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/599-wpa_supplicant-fix-warnings.patch
new file mode 100644
index 0000000..e70dc61
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/599-wpa_supplicant-fix-warnings.patch
@@ -0,0 +1,19 @@
+--- a/wpa_supplicant/wps_supplicant.h
++++ b/wpa_supplicant/wps_supplicant.h
+@@ -9,6 +9,7 @@
+ #ifndef WPS_SUPPLICANT_H
+ #define WPS_SUPPLICANT_H
+
++struct wpa_bss;
+ struct wpa_scan_results;
+
+ #ifdef CONFIG_WPS
+@@ -16,8 +17,6 @@ struct wpa_scan_results;
+ #include "wps/wps.h"
+ #include "wps/wps_defs.h"
+
+-struct wpa_bss;
+-
+ struct wps_new_ap_settings {
+ const char *ssid_hex;
+ const char *auth;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/600-ubus_support.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/600-ubus_support.patch
new file mode 100644
index 0000000..521e7df
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/600-ubus_support.patch
@@ -0,0 +1,619 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -166,6 +166,11 @@ OBJS += ../src/common/hw_features_common
+
+ OBJS += ../src/eapol_auth/eapol_auth_sm.o
+
++ifdef CONFIG_UBUS
++CFLAGS += -DUBUS_SUPPORT
++OBJS += ../src/ap/ubus.o
++LIBS += -lubox -lubus
++endif
+
+ ifdef CONFIG_CODE_COVERAGE
+ CFLAGS += -O0 -fprofile-arcs -ftest-coverage
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -18,6 +18,7 @@
+ #include "utils/list.h"
+ #include "ap_config.h"
+ #include "drivers/driver.h"
++#include "ubus.h"
+
+ #define OCE_STA_CFON_ENABLED(hapd) \
+ ((hapd->conf->oce & OCE_STA_CFON) && \
+@@ -92,7 +93,7 @@ struct hapd_interfaces {
+ #ifdef CONFIG_CTRL_IFACE_UDP
+ unsigned char ctrl_iface_cookie[CTRL_IFACE_COOKIE_LEN];
+ #endif /* CONFIG_CTRL_IFACE_UDP */
+-
++ struct ubus_object ubus;
+ };
+
+ enum hostapd_chan_status {
+@@ -183,6 +184,7 @@ struct hostapd_data {
+ struct hostapd_iface *iface;
+ struct hostapd_config *iconf;
+ struct hostapd_bss_config *conf;
++ struct hostapd_ubus_bss ubus;
+ int interface_added; /* virtual interface added for this BSS */
+ unsigned int started:1;
+ unsigned int disabled:1;
+@@ -673,6 +675,7 @@ hostapd_alloc_bss_data(struct hostapd_if
+ struct hostapd_bss_config *bss);
+ int hostapd_setup_interface(struct hostapd_iface *iface);
+ int hostapd_setup_interface_complete(struct hostapd_iface *iface, int err);
++void hostapd_set_own_neighbor_report(struct hostapd_data *hapd);
+ void hostapd_interface_deinit(struct hostapd_iface *iface);
+ void hostapd_interface_free(struct hostapd_iface *iface);
+ struct hostapd_iface * hostapd_alloc_iface(void);
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -401,6 +401,7 @@ void hostapd_free_hapd_data(struct hosta
+ hapd->beacon_set_done = 0;
+
+ wpa_printf(MSG_DEBUG, "%s(%s)", __func__, hapd->conf->iface);
++ hostapd_ubus_free_bss(hapd);
+ accounting_deinit(hapd);
+ hostapd_deinit_wpa(hapd);
+ vlan_deinit(hapd);
+@@ -1431,6 +1432,8 @@ static int hostapd_setup_bss(struct host
+ if (hapd->driver && hapd->driver->set_operstate)
+ hapd->driver->set_operstate(hapd->drv_priv, 1);
+
++ hostapd_ubus_add_bss(hapd);
++
+ return 0;
+ }
+
+@@ -2050,6 +2053,7 @@ static int hostapd_setup_interface_compl
+ if (err)
+ goto fail;
+
++ hostapd_ubus_add_iface(iface);
+ wpa_printf(MSG_DEBUG, "Completing interface initialization");
+ if (iface->freq) {
+ #ifdef NEED_AP_MLME
+@@ -2248,6 +2252,7 @@ dfs_offload:
+
+ fail:
+ wpa_printf(MSG_ERROR, "Interface initialization failed");
++ hostapd_ubus_free_iface(iface);
+ hostapd_set_state(iface, HAPD_IFACE_DISABLED);
+ wpa_msg(hapd->msg_ctx, MSG_INFO, AP_EVENT_DISABLED);
+ #ifdef CONFIG_FST
+@@ -2723,6 +2728,7 @@ void hostapd_interface_deinit_free(struc
+ (unsigned int) iface->conf->num_bss);
+ driver = iface->bss[0]->driver;
+ drv_priv = iface->bss[0]->drv_priv;
++ hostapd_ubus_free_iface(iface);
+ hostapd_interface_deinit(iface);
+ wpa_printf(MSG_DEBUG, "%s: driver=%p drv_priv=%p -> hapd_deinit",
+ __func__, driver, drv_priv);
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -3573,13 +3573,18 @@ static void handle_auth(struct hostapd_d
+ u16 auth_alg, auth_transaction, status_code;
+ u16 resp = WLAN_STATUS_SUCCESS;
+ struct sta_info *sta = NULL;
+- int res, reply_res;
++ int res, reply_res, ubus_resp;
+ u16 fc;
+ const u8 *challenge = NULL;
+ u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
+ size_t resp_ies_len = 0;
+ u16 seq_ctrl;
+ struct radius_sta rad_info;
++ struct hostapd_ubus_request req = {
++ .type = HOSTAPD_UBUS_AUTH_REQ,
++ .mgmt_frame = mgmt,
++ .ssi_signal = rssi,
++ };
+
+ if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
+ wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
+@@ -3747,6 +3752,13 @@ static void handle_auth(struct hostapd_d
+ resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ goto fail;
+ }
++ ubus_resp = hostapd_ubus_handle_event(hapd, &req);
++ if (ubus_resp) {
++ wpa_printf(MSG_DEBUG, "Station " MACSTR " rejected by ubus handler.\n",
++ MAC2STR(mgmt->sa));
++ resp = ubus_resp > 0 ? (u16) ubus_resp : WLAN_STATUS_UNSPECIFIED_FAILURE;
++ goto fail;
++ }
+ if (res == HOSTAPD_ACL_PENDING)
+ return;
+
+@@ -5488,7 +5500,7 @@ static void handle_assoc(struct hostapd_
+ int resp = WLAN_STATUS_SUCCESS;
+ u16 reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ const u8 *pos;
+- int left, i;
++ int left, i, ubus_resp;
+ struct sta_info *sta;
+ u8 *tmp = NULL;
+ #ifdef CONFIG_FILS
+@@ -5701,6 +5713,11 @@ static void handle_assoc(struct hostapd_
+ left = res;
+ }
+ #endif /* CONFIG_FILS */
++ struct hostapd_ubus_request req = {
++ .type = HOSTAPD_UBUS_ASSOC_REQ,
++ .mgmt_frame = mgmt,
++ .ssi_signal = rssi,
++ };
+
+ /* followed by SSID and Supported rates; and HT capabilities if 802.11n
+ * is used */
+@@ -5799,6 +5816,13 @@ static void handle_assoc(struct hostapd_
+ }
+ #endif /* CONFIG_FILS */
+
++ ubus_resp = hostapd_ubus_handle_event(hapd, &req);
++ if (ubus_resp) {
++ wpa_printf(MSG_DEBUG, "Station " MACSTR " assoc rejected by ubus handler.\n",
++ MAC2STR(mgmt->sa));
++ resp = ubus_resp > 0 ? (u16) ubus_resp : WLAN_STATUS_UNSPECIFIED_FAILURE;
++ goto fail;
++ }
+ fail:
+
+ /*
+@@ -5892,6 +5916,7 @@ static void handle_disassoc(struct hosta
+ wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
+ MAC2STR(mgmt->sa),
+ le_to_host16(mgmt->u.disassoc.reason_code));
++ hostapd_ubus_notify(hapd, "disassoc", mgmt->sa);
+
+ sta = ap_get_sta(hapd, mgmt->sa);
+ if (sta == NULL) {
+@@ -5961,6 +5986,8 @@ static void handle_deauth(struct hostapd
+ /* Clear the PTKSA cache entries for PASN */
+ ptksa_cache_flush(hapd->ptksa, mgmt->sa, WPA_CIPHER_NONE);
+
++ hostapd_ubus_notify(hapd, "deauth", mgmt->sa);
++
+ sta = ap_get_sta(hapd, mgmt->sa);
+ if (sta == NULL) {
+ wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -919,6 +919,12 @@ void handle_probe_req(struct hostapd_dat
+ u16 csa_offs[2];
+ size_t csa_offs_len;
+ struct radius_sta rad_info;
++ struct hostapd_ubus_request req = {
++ .type = HOSTAPD_UBUS_PROBE_REQ,
++ .mgmt_frame = mgmt,
++ .ssi_signal = ssi_signal,
++ .elems = &elems,
++ };
+
+ if (hapd->iconf->rssi_ignore_probe_request && ssi_signal &&
+ ssi_signal < hapd->iconf->rssi_ignore_probe_request)
+@@ -1105,6 +1111,12 @@ void handle_probe_req(struct hostapd_dat
+ }
+ #endif /* CONFIG_P2P */
+
++ if (hostapd_ubus_handle_event(hapd, &req)) {
++ wpa_printf(MSG_DEBUG, "Probe request for " MACSTR " rejected by ubus handler.\n",
++ MAC2STR(mgmt->sa));
++ return;
++ }
++
+ /* TODO: verify that supp_rates contains at least one matching rate
+ * with AP configuration */
+
+--- a/src/ap/drv_callbacks.c
++++ b/src/ap/drv_callbacks.c
+@@ -145,6 +145,10 @@ int hostapd_notif_assoc(struct hostapd_d
+ u16 reason = WLAN_REASON_UNSPECIFIED;
+ int status = WLAN_STATUS_SUCCESS;
+ const u8 *p2p_dev_addr = NULL;
++ struct hostapd_ubus_request req = {
++ .type = HOSTAPD_UBUS_ASSOC_REQ,
++ .addr = addr,
++ };
+
+ if (addr == NULL) {
+ /*
+@@ -237,6 +241,12 @@ int hostapd_notif_assoc(struct hostapd_d
+ goto fail;
+ }
+
++ if (hostapd_ubus_handle_event(hapd, &req)) {
++ wpa_printf(MSG_DEBUG, "Station " MACSTR " assoc rejected by ubus handler.\n",
++ MAC2STR(req.addr));
++ goto fail;
++ }
++
+ #ifdef CONFIG_P2P
+ if (elems.p2p) {
+ wpabuf_free(sta->p2p_ie);
+--- a/src/ap/sta_info.c
++++ b/src/ap/sta_info.c
+@@ -460,6 +460,7 @@ void ap_handle_timer(void *eloop_ctx, vo
+ hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
+ HOSTAPD_LEVEL_INFO, "deauthenticated due to "
+ "local deauth request");
++ hostapd_ubus_notify(hapd, "local-deauth", sta->addr);
+ ap_free_sta(hapd, sta);
+ return;
+ }
+@@ -615,6 +616,7 @@ skip_poll:
+ mlme_deauthenticate_indication(
+ hapd, sta,
+ WLAN_REASON_PREV_AUTH_NOT_VALID);
++ hostapd_ubus_notify(hapd, "inactive-deauth", sta->addr);
+ ap_free_sta(hapd, sta);
+ break;
+ }
+@@ -1298,12 +1300,25 @@ void ap_sta_set_authorized(struct hostap
+ sta->addr, authorized, dev_addr);
+
+ if (authorized) {
++ static const char * const auth_algs[] = {
++ [WLAN_AUTH_OPEN] = "open",
++ [WLAN_AUTH_SHARED_KEY] = "shared",
++ [WLAN_AUTH_FT] = "ft",
++ [WLAN_AUTH_SAE] = "sae",
++ [WLAN_AUTH_FILS_SK] = "fils-sk",
++ [WLAN_AUTH_FILS_SK_PFS] = "fils-sk-pfs",
++ [WLAN_AUTH_FILS_PK] = "fils-pk",
++ [WLAN_AUTH_PASN] = "pasn",
++ };
++ const char *auth_alg = NULL;
+ const char *keyid;
+ char keyid_buf[100];
+ char ip_addr[100];
++ char alg_buf[100];
+
+ keyid_buf[0] = '\0';
+ ip_addr[0] = '\0';
++ alg_buf[0] = '\0';
+ #ifdef CONFIG_P2P
+ if (wpa_auth_get_ip_addr(sta->wpa_sm, ip_addr_buf) == 0) {
+ os_snprintf(ip_addr, sizeof(ip_addr),
+@@ -1313,22 +1328,31 @@ void ap_sta_set_authorized(struct hostap
+ }
+ #endif /* CONFIG_P2P */
+
++ if (sta->auth_alg < ARRAY_SIZE(auth_algs))
++ auth_alg = auth_algs[sta->auth_alg];
++
++ if (auth_alg)
++ os_snprintf(alg_buf, sizeof(alg_buf),
++ " auth_alg=%s", auth_alg);
++
+ keyid = ap_sta_wpa_get_keyid(hapd, sta);
+ if (keyid) {
+ os_snprintf(keyid_buf, sizeof(keyid_buf),
+ " keyid=%s", keyid);
+ }
+
+- wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s%s",
+- buf, ip_addr, keyid_buf);
++ hostapd_ubus_notify_authorized(hapd, sta, auth_alg);
++ wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s%s%s",
++ buf, ip_addr, keyid_buf, alg_buf);
+
+ if (hapd->msg_ctx_parent &&
+ hapd->msg_ctx_parent != hapd->msg_ctx)
+ wpa_msg_no_global(hapd->msg_ctx_parent, MSG_INFO,
+- AP_STA_CONNECTED "%s%s%s",
+- buf, ip_addr, keyid_buf);
++ AP_STA_CONNECTED "%s%s%s%s",
++ buf, ip_addr, keyid_buf, alg_buf);
+ } else {
+ wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED "%s", buf);
++ hostapd_ubus_notify(hapd, "disassoc", sta->addr);
+
+ if (hapd->msg_ctx_parent &&
+ hapd->msg_ctx_parent != hapd->msg_ctx)
+--- a/src/ap/wpa_auth_glue.c
++++ b/src/ap/wpa_auth_glue.c
+@@ -268,6 +268,7 @@ static void hostapd_wpa_auth_psk_failure
+ struct hostapd_data *hapd = ctx;
+ wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POSSIBLE_PSK_MISMATCH MACSTR,
+ MAC2STR(addr));
++ hostapd_ubus_notify(hapd, "key-mismatch", addr);
+ }
+
+
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -183,6 +183,12 @@ ifdef CONFIG_EAPOL_TEST
+ CFLAGS += -Werror -DEAPOL_TEST
+ endif
+
++ifdef CONFIG_UBUS
++CFLAGS += -DUBUS_SUPPORT
++OBJS += ubus.o
++LIBS += -lubox -lubus
++endif
++
+ ifdef CONFIG_CODE_COVERAGE
+ CFLAGS += -O0 -fprofile-arcs -ftest-coverage
+ LIBS += -lgcov
+@@ -977,6 +983,9 @@ ifdef CONFIG_CTRL_IFACE_MIB
+ CFLAGS += -DCONFIG_CTRL_IFACE_MIB
+ endif
+ OBJS += ../src/ap/ctrl_iface_ap.o
++ifdef CONFIG_UBUS
++OBJS += ../src/ap/ubus.o
++endif
+ endif
+
+ CFLAGS += -DEAP_SERVER -DEAP_SERVER_IDENTITY
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -7285,6 +7285,8 @@ struct wpa_supplicant * wpa_supplicant_a
+ }
+ #endif /* CONFIG_P2P */
+
++ wpas_ubus_add_bss(wpa_s);
++
+ return wpa_s;
+ }
+
+@@ -7311,6 +7313,8 @@ int wpa_supplicant_remove_iface(struct w
+ struct wpa_supplicant *parent = wpa_s->parent;
+ #endif /* CONFIG_MESH */
+
++ wpas_ubus_free_bss(wpa_s);
++
+ /* Remove interface from the global list of interfaces */
+ prev = global->ifaces;
+ if (prev == wpa_s) {
+@@ -7614,8 +7618,12 @@ int wpa_supplicant_run(struct wpa_global
+ eloop_register_signal_terminate(wpa_supplicant_terminate, global);
+ eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
+
++ wpas_ubus_add(global);
++
+ eloop_run();
+
++ wpas_ubus_free(global);
++
+ return 0;
+ }
+
+--- a/wpa_supplicant/wpa_supplicant_i.h
++++ b/wpa_supplicant/wpa_supplicant_i.h
+@@ -20,6 +20,7 @@
+ #include "wps/wps_defs.h"
+ #include "config_ssid.h"
+ #include "wmm_ac.h"
++#include "ubus.h"
+
+ extern const char *const wpa_supplicant_version;
+ extern const char *const wpa_supplicant_license;
+@@ -323,6 +324,8 @@ struct wpa_global {
+ #endif /* CONFIG_WIFI_DISPLAY */
+
+ struct psk_list_entry *add_psk; /* From group formation */
++
++ struct ubus_object ubus_global;
+ };
+
+
+@@ -707,6 +710,7 @@ struct wpa_supplicant {
+ unsigned char own_addr[ETH_ALEN];
+ unsigned char perm_addr[ETH_ALEN];
+ char ifname[100];
++ struct wpas_ubus_bss ubus;
+ #ifdef CONFIG_MATCH_IFACE
+ int matched;
+ #endif /* CONFIG_MATCH_IFACE */
+--- a/wpa_supplicant/wps_supplicant.c
++++ b/wpa_supplicant/wps_supplicant.c
+@@ -33,6 +33,7 @@
+ #include "p2p/p2p.h"
+ #include "p2p_supplicant.h"
+ #include "wps_supplicant.h"
++#include "ubus.h"
+
+
+ #ifndef WPS_PIN_SCAN_IGNORE_SEL_REG
+@@ -391,6 +392,8 @@ static int wpa_supplicant_wps_cred(void
+ wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
+ cred->cred_attr, cred->cred_attr_len);
+
++ wpas_ubus_notify(wpa_s, cred);
++
+ if (wpa_s->conf->wps_cred_processing == 1)
+ return 0;
+
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -897,6 +897,7 @@ int main(int argc, char *argv[])
+ }
+
+ hostapd_global_ctrl_iface_init(&interfaces);
++ hostapd_ubus_add(&interfaces);
+
+ if (hostapd_global_run(&interfaces, daemonize, pid_file)) {
+ wpa_printf(MSG_ERROR, "Failed to start eloop");
+@@ -906,6 +907,7 @@ int main(int argc, char *argv[])
+ ret = 0;
+
+ out:
++ hostapd_ubus_free(&interfaces);
+ hostapd_global_ctrl_iface_deinit(&interfaces);
+ /* Deinitialize all interfaces */
+ for (i = 0; i < interfaces.count; i++) {
+--- a/wpa_supplicant/main.c
++++ b/wpa_supplicant/main.c
+@@ -204,7 +204,7 @@ int main(int argc, char *argv[])
+
+ for (;;) {
+ c = getopt(argc, argv,
+- "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuv::W");
++ "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:nNo:O:p:P:qsTtuv::W");
+ if (c < 0)
+ break;
+ switch (c) {
+@@ -272,6 +272,9 @@ int main(int argc, char *argv[])
+ params.conf_p2p_dev = optarg;
+ break;
+ #endif /* CONFIG_P2P */
++ case 'n':
++ iface_count = 0;
++ break;
+ case 'o':
+ params.override_driver = optarg;
+ break;
+--- a/src/ap/rrm.c
++++ b/src/ap/rrm.c
+@@ -89,6 +89,9 @@ static void hostapd_handle_beacon_report
+ return;
+ wpa_msg(hapd->msg_ctx, MSG_INFO, BEACON_RESP_RX MACSTR " %u %02x %s",
+ MAC2STR(addr), token, rep_mode, report);
++ if (len < sizeof(struct rrm_measurement_beacon_report))
++ return;
++ hostapd_ubus_notify_beacon_report(hapd, addr, token, rep_mode, (struct rrm_measurement_beacon_report*) pos, len);
+ }
+
+
+@@ -352,6 +355,9 @@ void hostapd_handle_radio_measurement(st
+ mgmt->u.action.u.rrm.action, MAC2STR(mgmt->sa));
+
+ switch (mgmt->u.action.u.rrm.action) {
++ case WLAN_RRM_LINK_MEASUREMENT_REPORT:
++ hostapd_ubus_handle_link_measurement(hapd, buf, len);
++ break;
+ case WLAN_RRM_RADIO_MEASUREMENT_REPORT:
+ hostapd_handle_radio_msmt_report(hapd, buf, len);
+ break;
+--- a/src/ap/vlan_init.c
++++ b/src/ap/vlan_init.c
+@@ -22,6 +22,7 @@
+ static int vlan_if_add(struct hostapd_data *hapd, struct hostapd_vlan *vlan,
+ int existsok)
+ {
++ bool vlan_exists = iface_exists(vlan->ifname);
+ int ret;
+ #ifdef CONFIG_WEP
+ int i;
+@@ -36,7 +37,7 @@ static int vlan_if_add(struct hostapd_da
+ }
+ #endif /* CONFIG_WEP */
+
+- if (!iface_exists(vlan->ifname))
++ if (!vlan_exists)
+ ret = hostapd_vlan_if_add(hapd, vlan->ifname);
+ else if (!existsok)
+ return -1;
+@@ -51,6 +52,9 @@ static int vlan_if_add(struct hostapd_da
+ if (hapd->wpa_auth)
+ ret = wpa_auth_ensure_group(hapd->wpa_auth, vlan->vlan_id);
+
++ if (!ret && !vlan_exists)
++ hostapd_ubus_add_vlan(hapd, vlan);
++
+ if (ret == 0)
+ return ret;
+
+@@ -77,6 +81,8 @@ int vlan_if_remove(struct hostapd_data *
+ "WPA deinitialization for VLAN %d failed (%d)",
+ vlan->vlan_id, ret);
+
++ hostapd_ubus_remove_vlan(hapd, vlan);
++
+ return hostapd_vlan_if_remove(hapd, vlan->ifname);
+ }
+
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1203,6 +1203,8 @@ int hostapd_dfs_pre_cac_expired(struct h
+ "freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d",
+ freq, ht_enabled, chan_offset, chan_width, cf1, cf2);
+
++ hostapd_ubus_notify_radar_detected(iface, freq, chan_width, cf1, cf2);
++
+ /* Proceed only if DFS is not offloaded to the driver */
+ if (iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD)
+ return 0;
+--- a/src/ap/airtime_policy.c
++++ b/src/ap/airtime_policy.c
+@@ -112,8 +112,14 @@ static void set_sta_weights(struct hosta
+ {
+ struct sta_info *sta;
+
+- for (sta = hapd->sta_list; sta; sta = sta->next)
+- sta_set_airtime_weight(hapd, sta, weight);
++ for (sta = hapd->sta_list; sta; sta = sta->next) {
++ unsigned int sta_weight = weight;
++
++ if (sta->dyn_airtime_weight)
++ sta_weight = (weight * sta->dyn_airtime_weight) / 256;
++
++ sta_set_airtime_weight(hapd, sta, sta_weight);
++ }
+ }
+
+
+@@ -244,7 +250,10 @@ int airtime_policy_new_sta(struct hostap
+ unsigned int weight;
+
+ if (hapd->iconf->airtime_mode == AIRTIME_MODE_STATIC) {
+- weight = get_weight_for_sta(hapd, sta->addr);
++ if (sta->dyn_airtime_weight)
++ weight = sta->dyn_airtime_weight;
++ else
++ weight = get_weight_for_sta(hapd, sta->addr);
+ if (weight)
+ return sta_set_airtime_weight(hapd, sta, weight);
+ }
+--- a/src/ap/sta_info.h
++++ b/src/ap/sta_info.h
+@@ -328,6 +328,7 @@ struct sta_info {
+ #endif /* CONFIG_TESTING_OPTIONS */
+ #ifdef CONFIG_AIRTIME_POLICY
+ unsigned int airtime_weight;
++ unsigned int dyn_airtime_weight;
+ struct os_reltime backlogged_until;
+ #endif /* CONFIG_AIRTIME_POLICY */
+
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -455,7 +455,8 @@ static void ieee802_11_rx_bss_trans_mgmt
+ MAC2STR(addr), reason, hex ? " neighbor=" : "", hex);
+ os_free(hex);
+
+- ieee802_11_send_bss_trans_mgmt_request(hapd, addr, dialog_token);
++ if (!hostapd_ubus_notify_bss_transition_query(hapd, addr, dialog_token, reason, pos, end - pos))
++ ieee802_11_send_bss_trans_mgmt_request(hapd, addr, dialog_token);
+ }
+
+
+@@ -477,7 +478,7 @@ static void ieee802_11_rx_bss_trans_mgmt
+ size_t len)
+ {
+ u8 dialog_token, status_code, bss_termination_delay;
+- const u8 *pos, *end;
++ const u8 *pos, *end, *target_bssid = NULL;
+ int enabled = hapd->conf->bss_transition;
+ struct sta_info *sta;
+
+@@ -524,6 +525,7 @@ static void ieee802_11_rx_bss_trans_mgmt
+ wpa_printf(MSG_DEBUG, "WNM: not enough room for Target BSSID field");
+ return;
+ }
++ target_bssid = pos;
+ sta->agreed_to_steer = 1;
+ eloop_cancel_timeout(ap_sta_reset_steer_flag_timer, hapd, sta);
+ eloop_register_timeout(2, 0, ap_sta_reset_steer_flag_timer,
+@@ -543,6 +545,10 @@ static void ieee802_11_rx_bss_trans_mgmt
+ MAC2STR(addr), status_code, bss_termination_delay);
+ }
+
++ hostapd_ubus_notify_bss_transition_response(hapd, sta->addr, dialog_token,
++ status_code, bss_termination_delay,
++ target_bssid, pos, end - pos);
++
+ wpa_hexdump(MSG_DEBUG, "WNM: BSS Transition Candidate List Entries",
+ pos, end - pos);
+ }
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/610-hostapd_cli_ujail_permission.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/610-hostapd_cli_ujail_permission.patch
new file mode 100644
index 0000000..a03fcc9
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/610-hostapd_cli_ujail_permission.patch
@@ -0,0 +1,33 @@
+--- a/src/common/wpa_ctrl.c
++++ b/src/common/wpa_ctrl.c
+@@ -135,7 +135,7 @@ try_again:
+ return NULL;
+ }
+ tries++;
+-#ifdef ANDROID
++
+ /* Set client socket file permissions so that bind() creates the client
+ * socket with these permissions and there is no need to try to change
+ * them with chmod() after bind() which would have potential issues with
+@@ -147,7 +147,7 @@ try_again:
+ * operations to allow the response to go through. Those are using the
+ * no-deference-symlinks version to avoid races. */
+ fchmod(ctrl->s, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+-#endif /* ANDROID */
++
+ if (bind(ctrl->s, (struct sockaddr *) &ctrl->local,
+ sizeof(ctrl->local)) < 0) {
+ if (errno == EADDRINUSE && tries < 2) {
+@@ -165,7 +165,11 @@ try_again:
+ return NULL;
+ }
+
+-#ifdef ANDROID
++#ifndef ANDROID
++ /* Set group even if we do not have privileges to change owner */
++ lchown(ctrl->local.sun_path, -1, 101);
++ lchown(ctrl->local.sun_path, 101, 101);
++#else
+ /* Set group even if we do not have privileges to change owner */
+ lchown(ctrl->local.sun_path, -1, AID_WIFI);
+ lchown(ctrl->local.sun_path, AID_SYSTEM, AID_WIFI);
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/700-wifi-reload.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/700-wifi-reload.patch
new file mode 100644
index 0000000..174127d
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/700-wifi-reload.patch
@@ -0,0 +1,220 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2416,6 +2416,8 @@ static int hostapd_config_fill(struct ho
+ bss->isolate = atoi(pos);
+ } else if (os_strcmp(buf, "ap_max_inactivity") == 0) {
+ bss->ap_max_inactivity = atoi(pos);
++ } else if (os_strcmp(buf, "config_id") == 0) {
++ bss->config_id = os_strdup(pos);
+ } else if (os_strcmp(buf, "skip_inactivity_poll") == 0) {
+ bss->skip_inactivity_poll = atoi(pos);
+ } else if (os_strcmp(buf, "country_code") == 0) {
+@@ -3121,6 +3123,8 @@ static int hostapd_config_fill(struct ho
+ }
+ } else if (os_strcmp(buf, "acs_exclude_dfs") == 0) {
+ conf->acs_exclude_dfs = atoi(pos);
++ } else if (os_strcmp(buf, "radio_config_id") == 0) {
++ conf->config_id = os_strdup(pos);
+ } else if (os_strcmp(buf, "op_class") == 0) {
+ conf->op_class = atoi(pos);
+ } else if (os_strcmp(buf, "channel") == 0) {
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -796,6 +796,7 @@ void hostapd_config_free_bss(struct host
+ os_free(conf->radius_req_attr_sqlite);
+ os_free(conf->rsn_preauth_interfaces);
+ os_free(conf->ctrl_interface);
++ os_free(conf->config_id);
+ os_free(conf->ca_cert);
+ os_free(conf->server_cert);
+ os_free(conf->server_cert2);
+@@ -995,6 +996,7 @@ void hostapd_config_free(struct hostapd_
+
+ for (i = 0; i < conf->num_bss; i++)
+ hostapd_config_free_bss(conf->bss[i]);
++ os_free(conf->config_id);
+ os_free(conf->bss);
+ os_free(conf->supported_rates);
+ os_free(conf->basic_rates);
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -285,6 +285,8 @@ struct hostapd_bss_config {
+ char vlan_bridge[IFNAMSIZ + 1];
+ char wds_bridge[IFNAMSIZ + 1];
+
++ char *config_id;
++
+ enum hostapd_logger_level logger_syslog_level, logger_stdout_level;
+
+ unsigned int logger_syslog; /* module bitfield */
+@@ -969,6 +971,7 @@ struct eht_phy_capabilities_info {
+ struct hostapd_config {
+ struct hostapd_bss_config **bss, *last_bss;
+ size_t num_bss;
++ char *config_id;
+
+ u16 beacon_int;
+ int rts_threshold;
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -224,6 +224,10 @@ static int hostapd_iface_conf_changed(st
+ {
+ size_t i;
+
++ if (newconf->config_id != oldconf->config_id)
++ if (strcmp(newconf->config_id, oldconf->config_id))
++ return 1;
++
+ if (newconf->num_bss != oldconf->num_bss)
+ return 1;
+
+@@ -237,7 +241,7 @@ static int hostapd_iface_conf_changed(st
+ }
+
+
+-int hostapd_reload_config(struct hostapd_iface *iface)
++int hostapd_reload_config(struct hostapd_iface *iface, int reconf)
+ {
+ struct hapd_interfaces *interfaces = iface->interfaces;
+ struct hostapd_data *hapd = iface->bss[0];
+@@ -260,13 +264,16 @@ int hostapd_reload_config(struct hostapd
+ if (newconf == NULL)
+ return -1;
+
+- hostapd_clear_old(iface);
+-
+ oldconf = hapd->iconf;
+ if (hostapd_iface_conf_changed(newconf, oldconf)) {
+ char *fname;
+ int res;
+
++ if (reconf)
++ return -1;
++
++ hostapd_clear_old(iface);
++
+ wpa_printf(MSG_DEBUG,
+ "Configuration changes include interface/BSS modification - force full disable+enable sequence");
+ fname = os_strdup(iface->config_fname);
+@@ -291,6 +298,24 @@ int hostapd_reload_config(struct hostapd
+ wpa_printf(MSG_ERROR,
+ "Failed to enable interface on config reload");
+ return res;
++ } else {
++ for (j = 0; j < iface->num_bss; j++) {
++ hapd = iface->bss[j];
++ if (!hapd->config_id || strcmp(hapd->config_id, newconf->bss[j]->config_id)) {
++ hostapd_flush_old_stations(iface->bss[j],
++ WLAN_REASON_PREV_AUTH_NOT_VALID);
++#ifdef CONFIG_WEP
++ hostapd_broadcast_wep_clear(iface->bss[j]);
++#endif
++
++#ifndef CONFIG_NO_RADIUS
++ /* TODO: update dynamic data based on changed configuration
++ * items (e.g., open/close sockets, etc.) */
++ radius_client_flush(iface->bss[j]->radius, 0);
++#endif /* CONFIG_NO_RADIUS */
++ wpa_printf(MSG_INFO, "bss %zu changed", j);
++ }
++ }
+ }
+ iface->conf = newconf;
+
+@@ -307,6 +332,12 @@ int hostapd_reload_config(struct hostapd
+
+ for (j = 0; j < iface->num_bss; j++) {
+ hapd = iface->bss[j];
++ if (hapd->config_id) {
++ os_free(hapd->config_id);
++ hapd->config_id = NULL;
++ }
++ if (newconf->bss[j]->config_id)
++ hapd->config_id = strdup(newconf->bss[j]->config_id);
+ hapd->iconf = newconf;
+ hapd->conf = newconf->bss[j];
+ hostapd_reload_bss(hapd);
+@@ -2420,6 +2451,10 @@ hostapd_alloc_bss_data(struct hostapd_if
+ hapd->iconf = conf;
+ hapd->conf = bss;
+ hapd->iface = hapd_iface;
++ if (bss && bss->config_id)
++ hapd->config_id = strdup(bss->config_id);
++ else
++ hapd->config_id = NULL;
+ if (conf)
+ hapd->driver = conf->driver;
+ hapd->ctrl_sock = -1;
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -47,7 +47,7 @@ struct mesh_conf;
+ struct hostapd_iface;
+
+ struct hapd_interfaces {
+- int (*reload_config)(struct hostapd_iface *iface);
++ int (*reload_config)(struct hostapd_iface *iface, int reconf);
+ struct hostapd_config * (*config_read_cb)(const char *config_fname);
+ int (*ctrl_iface_init)(struct hostapd_data *hapd);
+ void (*ctrl_iface_deinit)(struct hostapd_data *hapd);
+@@ -185,6 +185,7 @@ struct hostapd_data {
+ struct hostapd_config *iconf;
+ struct hostapd_bss_config *conf;
+ struct hostapd_ubus_bss ubus;
++ char *config_id;
+ int interface_added; /* virtual interface added for this BSS */
+ unsigned int started:1;
+ unsigned int disabled:1;
+@@ -667,7 +668,7 @@ struct hostapd_iface {
+ int hostapd_for_each_interface(struct hapd_interfaces *interfaces,
+ int (*cb)(struct hostapd_iface *iface,
+ void *ctx), void *ctx);
+-int hostapd_reload_config(struct hostapd_iface *iface);
++int hostapd_reload_config(struct hostapd_iface *iface, int reconf);
+ void hostapd_reconfig_encryption(struct hostapd_data *hapd);
+ struct hostapd_data *
+ hostapd_alloc_bss_data(struct hostapd_iface *hapd_iface,
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -4852,6 +4852,9 @@ static int wpa_driver_nl80211_set_ap(voi
+ if (ret) {
+ wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
+ ret, strerror(-ret));
++ if (!bss->beacon_set)
++ ret = 0;
++ bss->beacon_set = 0;
+ } else {
+ bss->beacon_set = 1;
+ nl80211_set_bss(bss, params->cts_protect, params->preamble,
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -186,7 +186,7 @@ static int hostapd_ctrl_iface_update(str
+ iface->interfaces->config_read_cb = hostapd_ctrl_iface_config_read;
+ reload_opts = txt;
+
+- hostapd_reload_config(iface);
++ hostapd_reload_config(iface, 0);
+
+ iface->interfaces->config_read_cb = config_read_cb;
+ }
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -317,7 +317,7 @@ static void handle_term(int sig, void *s
+
+ static int handle_reload_iface(struct hostapd_iface *iface, void *ctx)
+ {
+- if (hostapd_reload_config(iface) < 0) {
++ if (hostapd_reload_config(iface, 0) < 0) {
+ wpa_printf(MSG_WARNING, "Failed to read new configuration "
+ "file - continuing with old.");
+ }
+--- a/src/ap/wps_hostapd.c
++++ b/src/ap/wps_hostapd.c
+@@ -315,7 +315,7 @@ static void wps_reload_config(void *eloo
+
+ wpa_printf(MSG_DEBUG, "WPS: Reload configuration data");
+ if (iface->interfaces == NULL ||
+- iface->interfaces->reload_config(iface) < 0) {
++ iface->interfaces->reload_config(iface, 1) < 0) {
+ wpa_printf(MSG_WARNING, "WPS: Failed to reload the updated "
+ "configuration");
+ }
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/710-vlan_no_bridge.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/710-vlan_no_bridge.patch
new file mode 100644
index 0000000..b06ef8f
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/710-vlan_no_bridge.patch
@@ -0,0 +1,41 @@
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -121,6 +121,7 @@ struct hostapd_ssid {
+ #define DYNAMIC_VLAN_OPTIONAL 1
+ #define DYNAMIC_VLAN_REQUIRED 2
+ int dynamic_vlan;
++ int vlan_no_bridge;
+ #define DYNAMIC_VLAN_NAMING_WITHOUT_DEVICE 0
+ #define DYNAMIC_VLAN_NAMING_WITH_DEVICE 1
+ #define DYNAMIC_VLAN_NAMING_END 2
+--- a/src/ap/vlan_full.c
++++ b/src/ap/vlan_full.c
+@@ -475,6 +475,9 @@ void vlan_newlink(const char *ifname, st
+ if (!vlan)
+ return;
+
++ if (hapd->conf->ssid.vlan_no_bridge)
++ goto out;
++
+ vlan->configured = 1;
+
+ notempty = vlan->vlan_desc.notempty;
+@@ -506,6 +509,7 @@ void vlan_newlink(const char *ifname, st
+ ifname, br_name, tagged[i], hapd);
+ }
+
++out:
+ ifconfig_up(ifname);
+ }
+
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3346,6 +3346,8 @@ static int hostapd_config_fill(struct ho
+ #ifndef CONFIG_NO_VLAN
+ } else if (os_strcmp(buf, "dynamic_vlan") == 0) {
+ bss->ssid.dynamic_vlan = atoi(pos);
++ } else if (os_strcmp(buf, "vlan_no_bridge") == 0) {
++ bss->ssid.vlan_no_bridge = atoi(pos);
+ } else if (os_strcmp(buf, "per_sta_vif") == 0) {
+ bss->ssid.per_sta_vif = atoi(pos);
+ } else if (os_strcmp(buf, "vlan_file") == 0) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/711-wds_bridge_force.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/711-wds_bridge_force.patch
new file mode 100644
index 0000000..169807c
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/711-wds_bridge_force.patch
@@ -0,0 +1,22 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2316,6 +2316,8 @@ static int hostapd_config_fill(struct ho
+ sizeof(conf->bss[0]->iface));
+ } else if (os_strcmp(buf, "bridge") == 0) {
+ os_strlcpy(bss->bridge, pos, sizeof(bss->bridge));
++ if (!bss->wds_bridge[0])
++ os_strlcpy(bss->wds_bridge, pos, sizeof(bss->wds_bridge));
+ } else if (os_strcmp(buf, "vlan_bridge") == 0) {
+ os_strlcpy(bss->vlan_bridge, pos, sizeof(bss->vlan_bridge));
+ } else if (os_strcmp(buf, "wds_bridge") == 0) {
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -340,8 +340,6 @@ int hostapd_set_wds_sta(struct hostapd_d
+ return -1;
+ if (hapd->conf->wds_bridge[0])
+ bridge = hapd->conf->wds_bridge;
+- else if (hapd->conf->bridge[0])
+- bridge = hapd->conf->bridge;
+ return hapd->driver->set_wds_sta(hapd->drv_priv, addr, aid, val,
+ bridge, ifname_wds);
+ }
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/720-iface_max_num_sta.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/720-iface_max_num_sta.patch
new file mode 100644
index 0000000..ed76d22
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/720-iface_max_num_sta.patch
@@ -0,0 +1,82 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2841,6 +2841,14 @@ static int hostapd_config_fill(struct ho
+ line, bss->max_num_sta, MAX_STA_COUNT);
+ return 1;
+ }
++ } else if (os_strcmp(buf, "iface_max_num_sta") == 0) {
++ conf->max_num_sta = atoi(pos);
++ if (conf->max_num_sta < 0 ||
++ conf->max_num_sta > MAX_STA_COUNT) {
++ wpa_printf(MSG_ERROR, "Line %d: Invalid max_num_sta=%d; allowed range 0..%d",
++ line, conf->max_num_sta, MAX_STA_COUNT);
++ return 1;
++ }
+ } else if (os_strcmp(buf, "wpa") == 0) {
+ bss->wpa = atoi(pos);
+ } else if (os_strcmp(buf, "extended_key_id") == 0) {
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -711,6 +711,7 @@ void hostapd_cleanup_cs_params(struct ho
+ void hostapd_periodic_iface(struct hostapd_iface *iface);
+ int hostapd_owe_trans_get_info(struct hostapd_data *hapd);
+ void hostapd_ocv_check_csa_sa_query(void *eloop_ctx, void *timeout_ctx);
++int hostapd_check_max_sta(struct hostapd_data *hapd);
+
+ void hostapd_switch_color(struct hostapd_data *hapd, u64 bitmap);
+ void hostapd_cleanup_cca_params(struct hostapd_data *hapd);
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -241,6 +241,30 @@ static int hostapd_iface_conf_changed(st
+ }
+
+
++static inline int hostapd_iface_num_sta(struct hostapd_iface *iface)
++{
++ int num_sta = 0;
++ int i;
++
++ for (i = 0; i < iface->num_bss; i++)
++ num_sta += iface->bss[i]->num_sta;
++
++ return num_sta;
++}
++
++
++int hostapd_check_max_sta(struct hostapd_data *hapd)
++{
++ if (hapd->num_sta >= hapd->conf->max_num_sta)
++ return 1;
++
++ if (hapd->iconf->max_num_sta &&
++ hostapd_iface_num_sta(hapd->iface) >= hapd->iconf->max_num_sta)
++ return 1;
++
++ return 0;
++}
++
+ int hostapd_reload_config(struct hostapd_iface *iface, int reconf)
+ {
+ struct hapd_interfaces *interfaces = iface->interfaces;
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1135,7 +1135,7 @@ void handle_probe_req(struct hostapd_dat
+ if (hapd->conf->no_probe_resp_if_max_sta &&
+ is_multicast_ether_addr(mgmt->da) &&
+ is_multicast_ether_addr(mgmt->bssid) &&
+- hapd->num_sta >= hapd->conf->max_num_sta &&
++ hostapd_check_max_sta(hapd) &&
+ !ap_get_sta(hapd, mgmt->sa)) {
+ wpa_printf(MSG_MSGDUMP, "%s: Ignore Probe Request from " MACSTR
+ " since no room for additional STA",
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1010,6 +1010,8 @@ struct hostapd_config {
+ unsigned int track_sta_max_num;
+ unsigned int track_sta_max_age;
+
++ int max_num_sta;
++
+ char country[3]; /* first two octets: country code as described in
+ * ISO/IEC 3166-1. Third octet:
+ * ' ' (ascii 32): all environments
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/730-ft_iface.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/730-ft_iface.patch
new file mode 100644
index 0000000..d9a4f15
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/730-ft_iface.patch
@@ -0,0 +1,38 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3000,6 +3000,8 @@ static int hostapd_config_fill(struct ho
+ wpa_printf(MSG_INFO,
+ "Line %d: Obsolete peerkey parameter ignored", line);
+ #ifdef CONFIG_IEEE80211R_AP
++ } else if (os_strcmp(buf, "ft_iface") == 0) {
++ os_strlcpy(bss->ft_iface, pos, sizeof(bss->ft_iface));
+ } else if (os_strcmp(buf, "mobility_domain") == 0) {
+ if (os_strlen(pos) != 2 * MOBILITY_DOMAIN_ID_LEN ||
+ hexstr2bin(pos, bss->mobility_domain,
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -283,6 +283,7 @@ struct airtime_sta_weight {
+ struct hostapd_bss_config {
+ char iface[IFNAMSIZ + 1];
+ char bridge[IFNAMSIZ + 1];
++ char ft_iface[IFNAMSIZ + 1];
+ char vlan_bridge[IFNAMSIZ + 1];
+ char wds_bridge[IFNAMSIZ + 1];
+
+--- a/src/ap/wpa_auth_glue.c
++++ b/src/ap/wpa_auth_glue.c
+@@ -1595,8 +1595,12 @@ int hostapd_setup_wpa(struct hostapd_dat
+ wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt)) {
+ const char *ft_iface;
+
+- ft_iface = hapd->conf->bridge[0] ? hapd->conf->bridge :
+- hapd->conf->iface;
++ if (hapd->conf->ft_iface[0])
++ ft_iface = hapd->conf->ft_iface;
++ else if (hapd->conf->bridge[0])
++ ft_iface = hapd->conf->bridge;
++ else
++ ft_iface = hapd->conf->iface;
+ hapd->l2 = l2_packet_init(ft_iface, NULL, ETH_P_RRB,
+ hostapd_rrb_receive, hapd, 1);
+ if (!hapd->l2) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/740-snoop_iface.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/740-snoop_iface.patch
new file mode 100644
index 0000000..608f15a
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/740-snoop_iface.patch
@@ -0,0 +1,66 @@
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -284,6 +284,7 @@ struct hostapd_bss_config {
+ char iface[IFNAMSIZ + 1];
+ char bridge[IFNAMSIZ + 1];
+ char ft_iface[IFNAMSIZ + 1];
++ char snoop_iface[IFNAMSIZ + 1];
+ char vlan_bridge[IFNAMSIZ + 1];
+ char wds_bridge[IFNAMSIZ + 1];
+
+--- a/src/ap/x_snoop.c
++++ b/src/ap/x_snoop.c
+@@ -33,14 +33,16 @@ int x_snoop_init(struct hostapd_data *ha
+
+ hapd->x_snoop_initialized = true;
+
+- if (hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_HAIRPIN_MODE,
++ if (!conf->snoop_iface[0] &&
++ hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_HAIRPIN_MODE,
+ 1)) {
+ wpa_printf(MSG_DEBUG,
+ "x_snoop: Failed to enable hairpin_mode on the bridge port");
+ return -1;
+ }
+
+- if (hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_PROXYARP, 1)) {
++ if (!conf->snoop_iface[0] &&
++ hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_PROXYARP, 1)) {
+ wpa_printf(MSG_DEBUG,
+ "x_snoop: Failed to enable proxyarp on the bridge port");
+ return -1;
+@@ -54,7 +56,8 @@ int x_snoop_init(struct hostapd_data *ha
+ }
+
+ #ifdef CONFIG_IPV6
+- if (hostapd_drv_br_set_net_param(hapd, DRV_BR_MULTICAST_SNOOPING, 1)) {
++ if (!conf->snoop_iface[0] &&
++ hostapd_drv_br_set_net_param(hapd, DRV_BR_MULTICAST_SNOOPING, 1)) {
+ wpa_printf(MSG_DEBUG,
+ "x_snoop: Failed to enable multicast snooping on the bridge");
+ return -1;
+@@ -73,8 +76,12 @@ x_snoop_get_l2_packet(struct hostapd_dat
+ {
+ struct hostapd_bss_config *conf = hapd->conf;
+ struct l2_packet_data *l2;
++ const char *ifname = conf->bridge;
+
+- l2 = l2_packet_init(conf->bridge, NULL, ETH_P_ALL, handler, hapd, 1);
++ if (conf->snoop_iface[0])
++ ifname = conf->snoop_iface;
++
++ l2 = l2_packet_init(ifname, NULL, ETH_P_ALL, handler, hapd, 1);
+ if (l2 == NULL) {
+ wpa_printf(MSG_DEBUG,
+ "x_snoop: Failed to initialize L2 packet processing %s",
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2318,6 +2318,8 @@ static int hostapd_config_fill(struct ho
+ os_strlcpy(bss->bridge, pos, sizeof(bss->bridge));
+ if (!bss->wds_bridge[0])
+ os_strlcpy(bss->wds_bridge, pos, sizeof(bss->wds_bridge));
++ } else if (os_strcmp(buf, "snoop_iface") == 0) {
++ os_strlcpy(bss->snoop_iface, pos, sizeof(bss->snoop_iface));
+ } else if (os_strcmp(buf, "vlan_bridge") == 0) {
+ os_strlcpy(bss->vlan_bridge, pos, sizeof(bss->vlan_bridge));
+ } else if (os_strcmp(buf, "wds_bridge") == 0) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/750-qos_map_set_without_interworking.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/750-qos_map_set_without_interworking.patch
new file mode 100644
index 0000000..479d561
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/750-qos_map_set_without_interworking.patch
@@ -0,0 +1,97 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -1602,6 +1602,8 @@ static int parse_anqp_elem(struct hostap
+ return 0;
+ }
+
++#endif /* CONFIG_INTERWORKING */
++
+
+ static int parse_qos_map_set(struct hostapd_bss_config *bss,
+ char *buf, int line)
+@@ -1643,8 +1645,6 @@ static int parse_qos_map_set(struct host
+ return 0;
+ }
+
+-#endif /* CONFIG_INTERWORKING */
+-
+
+ #ifdef CONFIG_HS20
+ static int hs20_parse_conn_capab(struct hostapd_bss_config *bss, char *buf,
+@@ -4046,10 +4046,10 @@ static int hostapd_config_fill(struct ho
+ bss->gas_frag_limit = val;
+ } else if (os_strcmp(buf, "gas_comeback_delay") == 0) {
+ bss->gas_comeback_delay = atoi(pos);
++#endif /* CONFIG_INTERWORKING */
+ } else if (os_strcmp(buf, "qos_map_set") == 0) {
+ if (parse_qos_map_set(bss, pos, line) < 0)
+ return 1;
+-#endif /* CONFIG_INTERWORKING */
+ #ifdef CONFIG_RADIUS_TEST
+ } else if (os_strcmp(buf, "dump_msk_file") == 0) {
+ os_free(bss->dump_msk_file);
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -1424,6 +1424,7 @@ static int hostapd_setup_bss(struct host
+ wpa_printf(MSG_ERROR, "GAS server initialization failed");
+ return -1;
+ }
++#endif /* CONFIG_INTERWORKING */
+
+ if (conf->qos_map_set_len &&
+ hostapd_drv_set_qos_map(hapd, conf->qos_map_set,
+@@ -1431,7 +1432,6 @@ static int hostapd_setup_bss(struct host
+ wpa_printf(MSG_ERROR, "Failed to initialize QoS Map");
+ return -1;
+ }
+-#endif /* CONFIG_INTERWORKING */
+
+ if (conf->bss_load_update_period && bss_load_update_init(hapd)) {
+ wpa_printf(MSG_ERROR, "BSS Load initialization failed");
+--- a/wpa_supplicant/events.c
++++ b/wpa_supplicant/events.c
+@@ -2586,8 +2586,6 @@ void wnm_bss_keep_alive_deinit(struct wp
+ }
+
+
+-#ifdef CONFIG_INTERWORKING
+-
+ static int wpas_qos_map_set(struct wpa_supplicant *wpa_s, const u8 *qos_map,
+ size_t len)
+ {
+@@ -2620,8 +2618,6 @@ static void interworking_process_assoc_r
+ }
+ }
+
+-#endif /* CONFIG_INTERWORKING */
+-
+
+ static void multi_ap_process_assoc_resp(struct wpa_supplicant *wpa_s,
+ const u8 *ies, size_t ies_len)
+@@ -2954,10 +2950,8 @@ static int wpa_supplicant_event_associnf
+ wnm_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
+ data->assoc_info.resp_ies_len);
+ #endif /* CONFIG_WNM */
+-#ifdef CONFIG_INTERWORKING
+ interworking_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
+ data->assoc_info.resp_ies_len);
+-#endif /* CONFIG_INTERWORKING */
+ if (wpa_s->hw_capab == CAPAB_VHT &&
+ get_ie(data->assoc_info.resp_ies,
+ data->assoc_info.resp_ies_len, WLAN_EID_VHT_CAP))
+--- a/src/ap/ieee802_11_shared.c
++++ b/src/ap/ieee802_11_shared.c
+@@ -1100,13 +1100,11 @@ u8 * hostapd_eid_rsnxe(struct hostapd_da
+ u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
+ const u8 *ext_capab_ie, size_t ext_capab_ie_len)
+ {
+-#ifdef CONFIG_INTERWORKING
+ /* check for QoS Map support */
+ if (ext_capab_ie_len >= 5) {
+ if (ext_capab_ie[4] & 0x01)
+ sta->qos_map_enabled = 1;
+ }
+-#endif /* CONFIG_INTERWORKING */
+
+ if (ext_capab_ie_len > 0) {
+ sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/751-qos_map_ignore_when_unsupported.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/751-qos_map_ignore_when_unsupported.patch
new file mode 100644
index 0000000..d90a275
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/751-qos_map_ignore_when_unsupported.patch
@@ -0,0 +1,12 @@
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -864,7 +864,8 @@ int hostapd_start_dfs_cac(struct hostapd
+ int hostapd_drv_set_qos_map(struct hostapd_data *hapd,
+ const u8 *qos_map_set, u8 qos_map_set_len)
+ {
+- if (!hapd->driver || !hapd->driver->set_qos_map || !hapd->drv_priv)
++ if (!hapd->driver || !hapd->driver->set_qos_map || !hapd->drv_priv ||
++ !(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_QOS_MAPPING))
+ return 0;
+ return hapd->driver->set_qos_map(hapd->drv_priv, qos_map_set,
+ qos_map_set_len);
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch
new file mode 100644
index 0000000..1d9e956
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch
@@ -0,0 +1,58 @@
+From 37528a5205cb0b9e2238b7d97fb2ff5457448f1c Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Thu, 8 Sep 2022 01:45:41 +0200
+Subject: [PATCH] acs: don't select indoor channel on outdoor operation
+
+Don't select channels designated for exclusive-indoor use when the
+country3 element is set on outdoor operation.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ src/ap/acs.c | 9 +++++++++
+ src/ap/dfs.c | 3 +++
+ 2 files changed, 12 insertions(+)
+
+--- a/src/ap/acs.c
++++ b/src/ap/acs.c
+@@ -552,6 +552,9 @@ static void acs_survey_mode_interference
+ if (chan->max_tx_power < iface->conf->min_tx_power)
+ continue;
+
++ if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
++ continue;
++
+ wpa_printf(MSG_DEBUG, "ACS: Survey analysis for channel %d (%d MHz)",
+ chan->chan, chan->freq);
+
+@@ -686,6 +689,9 @@ acs_find_ideal_chan_mode(struct hostapd_
+ if (chan->max_tx_power < iface->conf->min_tx_power)
+ continue;
+
++ if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
++ continue;
++
+ if (!chan_bw_allowed(chan, bw, 1, 1)) {
+ wpa_printf(MSG_DEBUG,
+ "ACS: Channel %d: BW %u is not supported",
+@@ -1067,6 +1073,9 @@ static int * acs_request_scan_add_freqs(
+ if (chan->max_tx_power < iface->conf->min_tx_power)
+ continue;
+
++ if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
++ continue;
++
+ *freq++ = chan->freq;
+ }
+
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -282,6 +282,9 @@ static int dfs_find_channel(struct hosta
+ if (chan->max_tx_power < iface->conf->min_tx_power)
+ continue;
+
++ if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
++ continue;
++
+ if (ret_chan && idx == channel_idx) {
+ wpa_printf(MSG_DEBUG, "Selected channel %d (%d)",
+ chan->freq, chan->chan);
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
new file mode 100644
index 0000000..e78a4ef
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
@@ -0,0 +1,33 @@
+From f0e9f5aab52b3eab85d28338cc996972ced4c39c Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Tue, 17 May 2022 23:07:59 +0200
+Subject: [PATCH] ctrl: make WNM_AP functions dependant on CONFIG_AP
+
+This fixes linking errors found when compiling wpa_supplicant with
+CONFIG_WNM_AP enabled but CONFIG_AP disabled.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ wpa_supplicant/ctrl_iface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/wpa_supplicant/ctrl_iface.c
++++ b/wpa_supplicant/ctrl_iface.c
+@@ -12241,7 +12241,7 @@ char * wpa_supplicant_ctrl_iface_process
+ if (wpas_ctrl_iface_coloc_intf_report(wpa_s, buf + 18))
+ reply_len = -1;
+ #endif /* CONFIG_WNM */
+-#ifdef CONFIG_WNM_AP
++#if defined(CONFIG_AP) && defined(CONFIG_WNM_AP)
+ } else if (os_strncmp(buf, "DISASSOC_IMMINENT ", 18) == 0) {
+ if (ap_ctrl_iface_disassoc_imminent(wpa_s, buf + 18))
+ reply_len = -1;
+@@ -12251,7 +12251,7 @@ char * wpa_supplicant_ctrl_iface_process
+ } else if (os_strncmp(buf, "BSS_TM_REQ ", 11) == 0) {
+ if (ap_ctrl_iface_bss_tm_req(wpa_s, buf + 11))
+ reply_len = -1;
+-#endif /* CONFIG_WNM_AP */
++#endif /* CONFIG_AP && CONFIG_WNM_AP */
+ } else if (os_strcmp(buf, "FLUSH") == 0) {
+ wpa_supplicant_ctrl_iface_flush(wpa_s);
+ } else if (os_strncmp(buf, "RADIO_WORK ", 11) == 0) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/992-openssl-include-rsa.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/992-openssl-include-rsa.patch
new file mode 100644
index 0000000..581ae9f
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/992-openssl-include-rsa.patch
@@ -0,0 +1,32 @@
+From f374d52079111a4340acb6df835f45ac6b5f3f60 Mon Sep 17 00:00:00 2001
+From: Andre Heider <a.heider@gmail.com>
+Date: Wed, 22 Jun 2022 14:13:55 +0200
+Subject: OpenSSL: Include rsa.h for all OpenSSL versions
+
+This fixes the build with OpenSSL 1.1.1:
+../src/crypto/crypto_openssl.c: In function 'crypto_rsa_oaep_sha256_decrypt':
+../src/crypto/crypto_openssl.c:4404:49: error: 'RSA_PKCS1_OAEP_PADDING' undeclared (first use in this function)
+
+Signed-off-by: Andre Heider <a.heider@gmail.com>
+---
+ src/crypto/crypto_openssl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/crypto/crypto_openssl.c
++++ b/src/crypto/crypto_openssl.c
+@@ -16,6 +16,7 @@
+ #include <openssl/dh.h>
+ #include <openssl/hmac.h>
+ #include <openssl/rand.h>
++#include <openssl/rsa.h>
+ #include <openssl/pem.h>
+ #ifdef CONFIG_ECC
+ #include <openssl/ec.h>
+@@ -25,7 +26,6 @@
+ #include <openssl/provider.h>
+ #include <openssl/core_names.h>
+ #include <openssl/param_build.h>
+-#include <openssl/rsa.h>
+ #include <openssl/encoder.h>
+ #include <openssl/decoder.h>
+ #else /* OpenSSL version >= 3.0 */
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
new file mode 100644
index 0000000..28af8ef
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
@@ -0,0 +1,475 @@
+From af1bd5256cc764fb222f9809996851ff3d879699 Mon Sep 17 00:00:00 2001
+From: "howard.hsu" <howard-yh.hsu@mediatek.com>
+Date: Wed, 19 Jan 2022 19:18:07 +0800
+Subject: [PATCH 99900/99909] hostapd: mtk: Add neighbor report and BSS
+ Termination for MBO certification
+
+1. Add hostapd_neighbor_count() and hostapd_neighbor_insert_buffer ()
+The first function can count the number of neighbor report in neighbore report
+database. The second can iterate neighbor report database to build up neighbor
+report data.
+
+2. Support including neighbor report elements in ANQP response
+3. Support including neignbor report elements in BTM response
+4. Support configuring BSS Termination TSF by using hostapd_cli command
+5. Disable interface if BSS Termination TSF is set
+6. Add set_send_disassoc_frame_timer() to send disassociate frame
+Function set_disassoc_timer() may fail if key was deleted first. This new
+function will not ask to delete key as set_disassoc_timer() did.
+7. Support including neighbor report elements in BTM request
+8. Add hostapd_neighbor_set_own_report_pref()
+9. Add hostapd_neighbor_set_pref_by_non_pref_chan()
+---
+ hostapd/ctrl_iface.c | 5 ++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 1 +
+ src/ap/ctrl_iface_ap.c | 19 ++++++-
+ src/ap/gas_serv.c | 29 ++++++++++
+ src/ap/gas_serv.h | 2 +
+ src/ap/neighbor_db.c | 119 +++++++++++++++++++++++++++++++++++++++++
+ src/ap/neighbor_db.h | 9 ++++
+ src/ap/wnm_ap.c | 72 +++++++++++++++++++++++--
+ 9 files changed, 252 insertions(+), 5 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index a258492..c2a2822 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1338,6 +1338,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
+ #endif /* CONFIG_DPP */
+ } else if (os_strcasecmp(cmd, "setband") == 0) {
+ ret = hostapd_ctrl_iface_set_band(hapd, value);
++ } else if (os_strcasecmp(cmd, "bss_termination_tsf") == 0) {
++ int termination_sec = atoi(value);
++ hapd->conf->bss_termination_tsf = termination_sec;
++ wpa_printf(MSG_DEBUG, "BSS Termination TSF: value = %d",
++ termination_sec);
+ } else {
+ ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
+ if (ret)
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index d7a0c7c..4a20eb4 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
+ /* comeback after 10 TUs */
+ bss->pasn_comeback_after = 10;
+ #endif /* CONFIG_PASN */
++ bss->bss_termination_tsf = 0;
+ }
+
+
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index ed3bec7..3f68e76 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -557,6 +557,7 @@ struct hostapd_bss_config {
+ int wnm_sleep_mode;
+ int wnm_sleep_mode_no_keys;
+ int bss_transition;
++ unsigned int bss_termination_tsf;
+
+ /* IEEE 802.11u - Interworking */
+ int interworking;
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index 96209ce..18bae5c 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1203,6 +1203,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ wpa_printf(MSG_DEBUG, "Invalid bss_term data");
+ return -1;
+ }
++ if (hapd->conf->bss_termination_tsf) {
++ WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
++ }
++
+ end++;
+ WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
+ }
+@@ -1229,14 +1233,25 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
+ }
+
+- if (os_strstr(cmd, " pref=1"))
++ if (os_strstr(cmd, " pref=1")) {
+ req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++ if (nei_len == 0) {
++ // Add neigibor report from neighbor report db to nei_rep buffer
++ nei_len = hostapd_neighbor_insert_buffer (hapd, nei_rep, 1000);
++ }
++ }
+ if (os_strstr(cmd, " abridged=1"))
+ req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
+- if (os_strstr(cmd, " disassoc_imminent=1"))
++ if (os_strstr(cmd, " disassoc_imminent=1")) {
+ req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
++ /* Set own BSS neighbor report preference value as 0 */
++ hostapd_neighbor_set_own_report_pref(hapd, nei_rep, nei_len, 0);
++ }
++
+
+ #ifdef CONFIG_MBO
++ hostapd_neighbor_set_pref_by_non_pref_chan(hapd, sta, nei_rep, nei_len);
++
+ pos = os_strstr(cmd, "mbo=");
+ if (pos) {
+ unsigned int mbo_reason, cell_pref, reassoc_delay;
+diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
+index 90f1577..5845ff8 100644
+--- a/src/ap/gas_serv.c
++++ b/src/ap/gas_serv.c
+@@ -19,6 +19,7 @@
+ #include "dpp_hostapd.h"
+ #include "sta_info.h"
+ #include "gas_serv.h"
++#include "neighbor_db.h"
+
+
+ #ifdef CONFIG_DPP
+@@ -369,6 +370,24 @@ static void anqp_add_network_auth_type(struct hostapd_data *hapd,
+ }
+ }
+
++static void anqp_add_neighbor_report(struct hostapd_data *hapd,
++ struct wpabuf *buf)
++{
++ struct hostapd_neighbor_entry *nr;
++ u8 *len_pos = gas_anqp_add_element(buf, ANQP_NEIGHBOR_REPORT);
++ if (dl_list_empty(&hapd->nr_db)) {
++ wpabuf_put_le16(buf, 0);
++ }
++ else {
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry, list ) {
++ wpabuf_put_u8(buf, WLAN_EID_NEIGHBOR_REPORT);
++ wpabuf_put_u8(buf, wpabuf_len(nr->nr));
++ wpabuf_put_buf(buf, nr->nr);
++ }
++ }
++ gas_anqp_set_element_len(buf, len_pos);
++}
++
+
+ static void anqp_add_roaming_consortium(struct hostapd_data *hapd,
+ struct wpabuf *buf)
+@@ -986,6 +1005,9 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ len += 1000;
+ if (request & ANQP_REQ_ICON_REQUEST)
+ len += 65536;
++ if (request & ANQP_REQ_NEIGHBOR_REPORT) {
++ len += (40 * hostapd_neighbor_count(hapd));
++ }
+ #ifdef CONFIG_FILS
+ if (request & ANQP_FILS_REALM_INFO)
+ len += 2 * dl_list_len(&hapd->conf->fils_realms);
+@@ -1028,6 +1050,8 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ anqp_add_elem(hapd, buf, ANQP_TDLS_CAPABILITY);
+ if (request & ANQP_REQ_EMERGENCY_NAI)
+ anqp_add_elem(hapd, buf, ANQP_EMERGENCY_NAI);
++ if (request & ANQP_REQ_NEIGHBOR_REPORT)
++ anqp_add_neighbor_report(hapd, buf);
+
+ for (i = 0; i < num_extra_req; i++) {
+ #ifdef CONFIG_FILS
+@@ -1172,6 +1196,11 @@ static void rx_anqp_query_list_id(struct hostapd_data *hapd, u16 info_id,
+ "Emergency NAI",
+ get_anqp_elem(hapd, info_id) != NULL, qi);
+ break;
++ case ANQP_NEIGHBOR_REPORT:
++ set_anqp_req(ANQP_REQ_NEIGHBOR_REPORT,
++ "Neighbor Report",
++ get_anqp_elem(hapd, info_id) != NULL, qi);
++ break;
+ default:
+ #ifdef CONFIG_FILS
+ if (info_id == ANQP_FILS_REALM_INFO &&
+diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
+index 1528af4..d0241f2 100644
+--- a/src/ap/gas_serv.h
++++ b/src/ap/gas_serv.h
+@@ -40,6 +40,8 @@
+ (1 << (ANQP_TDLS_CAPABILITY - ANQP_QUERY_LIST))
+ #define ANQP_REQ_EMERGENCY_NAI \
+ (1 << (ANQP_EMERGENCY_NAI - ANQP_QUERY_LIST))
++#define ANQP_REQ_NEIGHBOR_REPORT \
++ (1 << (ANQP_NEIGHBOR_REPORT - ANQP_QUERY_LIST))
+ /*
+ * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
+ * optimized bitmap.
+diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
+index 52f25eb..9254d09 100644
+--- a/src/ap/neighbor_db.c
++++ b/src/ap/neighbor_db.c
+@@ -89,6 +89,38 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
+ }
+
+
++int hostapd_neighbor_count(struct hostapd_data *hapd)
++{
++ struct hostapd_neighbor_entry *nr;
++ int count = 0;
++
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ count++;
++ }
++ return count;
++}
++
++
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++ size_t buflen)
++{
++ struct hostapd_neighbor_entry *nr;
++ char *pos = buf;
++
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ /* For neighbor report IE, we only need bssid and nr*/
++ *pos++ = WLAN_EID_NEIGHBOR_REPORT;
++ *pos++ = wpabuf_len(nr->nr);
++ os_memcpy(pos, wpabuf_head(nr->nr), wpabuf_len(nr->nr));
++ pos += wpabuf_len(nr->nr);
++ }
++
++ return pos - buf;
++}
++
++
+ static void hostapd_neighbor_clear_entry(struct hostapd_neighbor_entry *nr)
+ {
+ wpabuf_free(nr->nr);
+@@ -325,3 +357,90 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
+ wpabuf_free(nr);
+ #endif /* NEED_AP_MLME */
+ }
++
++
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++ size_t buflen, const int pref)
++{
++ struct hostapd_neighbor_entry *nr;
++ char *pos, *next_nr;
++
++ pos = nei_buf;
++ next_nr = nei_buf;
++
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ pos = next_nr;
++ next_nr = pos + 2 + wpabuf_len(nr->nr);
++ /* Shift 2 bytes for Element ID and Neighbor report length */
++ pos = pos + 2;
++ if(os_memcmp(pos, hapd->own_addr, ETH_ALEN) == 0) {
++ /* Shift for BSSID + BSSID info + Op_class + channel num + PHY type */
++ pos = pos + 6 + 4 + 1 + 1 + 1;
++
++ /* Iterate Subelement */
++ while (next_nr - pos > 0) {
++ if (*pos == 3) {
++ pos = pos + 2;
++ *pos = pref;
++ return;
++ } else {
++ pos++;
++ int shift_len = *pos++;
++ pos = pos + shift_len;
++ }
++ }
++ }
++ }
++}
++
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++ struct sta_info* sta, char *nei_buf, size_t buflen)
++{
++ struct hostapd_neighbor_entry *nr;
++ struct mbo_non_pref_chan_info *info;
++ u8 i;
++
++ for(info = sta->non_pref_chan; info; info = info->next) {
++ /* Check OP_Class and Channel num */
++ for(i = 0; i < info->num_channels; i++) {
++ char *pos, *next_nr;
++
++ pos = nei_buf;
++ next_nr = nei_buf;
++
++ /* Iterate Neighbor report database */
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ pos = next_nr;
++ next_nr = pos + 2 + wpabuf_len(nr->nr);
++ /**
++ * Shift 12 bytes for Element ID, Neighbor report length,
++ * BSSID and BSSID info.
++ */
++ pos = pos + 12;
++ int nr_op_class = *pos++;
++ int nr_channel = *pos;
++ if(info->op_class == nr_op_class && info->channels[i] == nr_channel) {
++ /* Shift for Channel Num + PHY type */
++ pos = pos + 1 + 1;
++
++ // Iterate Subelement
++ while(next_nr - pos > 0) {
++ if(*pos == 3) {
++ pos = pos + 2;
++ *pos = info->pref;
++ break;
++ }else {
++ pos++;
++ int shift_len = *pos++;
++ pos = pos + shift_len;
++ }
++ }
++ }
++ }
++ }
++ }
++}
++#endif
+diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
+index 992671b..a1ddc07 100644
+--- a/src/ap/neighbor_db.h
++++ b/src/ap/neighbor_db.h
+@@ -24,4 +24,13 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
+ const struct wpa_ssid_value *ssid);
+ void hostapd_free_neighbor_db(struct hostapd_data *hapd);
+
++int hostapd_neighbor_count(struct hostapd_data *hapd);
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++ size_t buflen);
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++ size_t buflen, const int pref);
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++ struct sta_info* sta, char *nei_buf, size_t buflen);
++#endif
+ #endif /* NEIGHBOR_DB_H */
+diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
+index 3ea92af..4349e1d 100644
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -20,6 +20,7 @@
+ #include "ap/wpa_auth.h"
+ #include "mbo_ap.h"
+ #include "wnm_ap.h"
++#include "ap/neighbor_db.h"
+
+ #define MAX_TFS_IE_LEN 1024
+
+@@ -370,9 +371,21 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ u8 *pos;
+ int res;
+
+- mgmt = os_zalloc(sizeof(*mgmt));
+- if (mgmt == NULL)
++ int nr_num = hostapd_neighbor_count(hapd);
++ int nr_size = ETH_ALEN + 4 + 1 + 1 + 1 + 5;
++ int total_nr_size = nr_num * nr_size;
++ u8 *nr_data = os_malloc(total_nr_size);
++ int nr_data_len = 0;
++ if(nr_data == NULL) {
++ wpa_printf (MSG_ERROR, "Failed to allocate memory");
++ } else {
++ nr_data_len = hostapd_neighbor_insert_buffer(hapd, nr_data, total_nr_size);
++ }
++ mgmt = os_zalloc(sizeof(*mgmt) + nr_data_len);
++ if (mgmt == NULL) {
++ wpa_printf (MSG_ERROR, "Failed to allocate memory for mgmt frame");
+ return -1;
++ }
+ os_memcpy(mgmt->da, addr, ETH_ALEN);
+ os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
+ os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
+@@ -382,10 +395,18 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ;
+ mgmt->u.action.u.bss_tm_req.dialog_token = dialog_token;
+ mgmt->u.action.u.bss_tm_req.req_mode = 0;
++ if(nr_num) {
++ mgmt->u.action.u.bss_tm_req.req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++ }
+ mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(0);
+ mgmt->u.action.u.bss_tm_req.validity_interval = 1;
+ pos = mgmt->u.action.u.bss_tm_req.variable;
+
++ if(nr_num) {
++ os_memcpy(pos, nr_data, nr_data_len);
++ pos += nr_data_len;
++ }
++
+ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
+ MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
+@@ -759,6 +780,50 @@ static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta,
+ }
+
+
++static void set_send_disassoc_frame_timer(struct hostapd_data *hapd, struct sta_info *sta,
++ int disassoc_timer)
++{
++ int timeout, beacon_int;
++
++ /*
++ * Prevent STA from reconnecting using cached PMKSA to force
++ * full authentication with the authentication server (which may
++ * decide to reject the connection),
++ */
++ wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
++
++ beacon_int = hapd->iconf->beacon_int;
++ if (beacon_int < 1)
++ beacon_int = 100; /* best guess */
++ /* Calculate timeout in ms based on beacon_int in TU */
++ timeout = disassoc_timer * beacon_int * 128 / 125;
++ wpa_printf(MSG_DEBUG, "Disassociation timer for " MACSTR
++ " set to %d ms", MAC2STR(sta->addr), timeout);
++
++ u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID;
++
++ hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
++ if (sta)
++ ap_sta_disassociate(hapd, sta, reason);
++}
++
++
++void bss_termination_disable_iface(void *eloop_ctx, void *timeout_ctx)
++{
++ struct hostapd_data *hapd = eloop_ctx;
++ hostapd_disable_iface(hapd->iface);
++}
++
++
++static void set_disable_iface_timer(struct hostapd_data *hapd, struct sta_info *sta,
++ int disable_iface_timer)
++{
++ wpa_printf(MSG_DEBUG, "Disable interface timer set to %d secs", disable_iface_timer);
++ eloop_register_timeout(disable_iface_timer, 0,
++ bss_termination_disable_iface, hapd, NULL);
++}
++
++
+ int wnm_send_ess_disassoc_imminent(struct hostapd_data *hapd,
+ struct sta_info *sta, const char *url,
+ int disassoc_timer)
+@@ -848,6 +913,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ bss_term_dur) {
+ os_memcpy(pos, bss_term_dur, 12);
+ pos += 12;
++ set_disable_iface_timer(hapd, sta, hapd->conf->bss_termination_tsf);
+ }
+
+ if (url) {
+@@ -884,7 +950,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ if (disassoc_timer) {
+ /* send disassociation frame after time-out */
+- set_disassoc_timer(hapd, sta, disassoc_timer);
++ set_send_disassoc_frame_timer(hapd, sta, disassoc_timer);
+ }
+
+ return 0;
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
new file mode 100644
index 0000000..054dfb0
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
@@ -0,0 +1,36 @@
+From f5c37c459c33bb8e228a88ba8efdea68bb75abd3 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 20 Sep 2022 19:33:45 +0800
+Subject: [PATCH 99901/99909] hostapd: mtk: print sae groups by hostapd ctrl
+
+---
+ hostapd/ctrl_iface.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c2a2822..bc690c5 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1412,6 +1412,19 @@ static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
+ if (os_snprintf_error(buflen, res))
+ return -1;
+ return res;
++ } else if (os_strcmp(cmd, "sae_group_capability") == 0) {
++#ifdef CONFIG_SAE
++ /* see sae_set_group() */
++ res = os_snprintf(buf, buflen, "%s%s%s%s19 20 21",
++ dh_groups_get(15) ? "15 ": "",
++ dh_groups_get(16) ? "16 ": "",
++ dh_groups_get(17) ? "17 ": "",
++ dh_groups_get(18) ? "18 ": "");
++
++ if (os_snprintf_error(buflen, res))
++ return -1;
++ return res;
++#endif /* CONFIG_SAE */
+ }
+
+ return -1;
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
new file mode 100644
index 0000000..6fa23c0
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
@@ -0,0 +1,211 @@
+From ce684a1adac0b5b699482924eb86f8f1b8205e57 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Tue, 31 May 2022 21:15:54 +0800
+Subject: [PATCH 99902/99909] hostapd: mtk: add support for runtime set in-band
+ discovery
+
+Usage:
+hostapd_cli unsolic_probe_resp [tx_type] [interval]
+
+0: disable all in-band discovery
+1: enable unsolicited probe response
+2: enable FILS discovery
+
+Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 66 ++++++++++++++++++++++++++++++++++++
+ hostapd/hostapd_cli.c | 20 +++++++++++
+ src/ap/beacon.c | 5 ++-
+ src/drivers/driver_nl80211.c | 10 ++++--
+ src/drivers/nl80211_copy.h | 1 +
+ 5 files changed, 98 insertions(+), 4 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index bc690c5..bb8c74f 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -826,6 +826,69 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
+
+ #endif /* CONFIG_INTERWORKING */
+
++static int hostapd_ctrl_iface_inband_discovery(struct hostapd_data *hapd,
++ const char *cmd)
++{
++ struct hostapd_bss_config *conf = hapd->conf;
++ const char *pos = cmd;
++ int tx_type, interval, ret;
++
++ tx_type = atoi(pos);
++ if (tx_type < 0 || tx_type > 2) {
++ wpa_printf(MSG_ERROR, "Invalid tx type\n");
++ return -1;
++ }
++
++ pos = os_strchr(pos, ' ');
++ if(!pos)
++ return -1;
++ pos++;
++ interval = atoi(pos);
++ if (interval < 0 || interval > 20) {
++ wpa_printf(MSG_ERROR, "Invalid interval value\n");
++ return -1;
++ }
++
++ wpa_printf(MSG_ERROR, "Set inband discovery type:%d, interval:%d\n",
++ tx_type, interval);
++
++#define DISABLE_INBAND_DISC 0
++#define UNSOL_PROBE_RESP 1
++#define FILS_DISCOVERY 2
++
++#ifdef CONFIG_FILS
++ conf->fils_discovery_max_int = 0;
++ conf->fils_discovery_min_int = 0;
++#endif /* CONFIG_FILS */
++ conf->unsol_bcast_probe_resp_interval = 0;
++
++ switch (tx_type) {
++ case DISABLE_INBAND_DISC:
++ default:
++ /* Disable both Unsolicited probe response and FILS discovery*/
++ break;
++ case UNSOL_PROBE_RESP:
++ /* Enable Unsolicited probe response */
++ conf->unsol_bcast_probe_resp_interval = interval;
++ break;
++#ifdef CONFIG_FILS
++ case FILS_DISCOVERY:
++ /* Enable FILS discovery */
++ conf->fils_discovery_min_int = interval;
++ conf->fils_discovery_max_int = interval;
++ break;
++#endif /* CONFIG_FILS */
++ }
++
++ ret = ieee802_11_update_beacons(hapd->iface);
++ if(ret) {
++ wpa_printf(MSG_DEBUG,
++ "Failed to update with inband discovery parameters\n");
++ return -1;
++ }
++
++ return 0;
++}
+
+ #ifdef CONFIG_WNM_AP
+
+@@ -3434,6 +3497,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ if (hostapd_ctrl_iface_coloc_intf_req(hapd, buf + 15))
+ reply_len = -1;
+ #endif /* CONFIG_WNM_AP */
++ } else if (os_strncmp(buf, "INBAND_DISCOVERY ", 17) == 0) {
++ if (hostapd_ctrl_iface_inband_discovery(hapd, buf + 17))
++ reply_len = -1;
+ } else if (os_strcmp(buf, "GET_CONFIG") == 0) {
+ reply_len = hostapd_ctrl_iface_get_config(hapd, reply,
+ reply_size);
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 85c41d0..db21258 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -642,6 +642,24 @@ static int hostapd_cli_cmd_wps_config(struct wpa_ctrl *ctrl, int argc,
+ return wpa_ctrl_command(ctrl, buf);
+ }
+
++static int hostapd_cli_cmd_inband_discovery(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ char buf[300];
++ int res;
++
++ if (argc < 2) {
++ printf("Invalid 'inband_discovery' command - two arguments"
++ "tx_type interval\n");
++ return -1;
++ }
++
++ res = os_snprintf(buf, sizeof(buf), "INBAND_DISCOVERY %s %s",
++ argv[0], argv[1]);
++ if (os_snprintf_error(sizeof(buf), res))
++ return -1;
++ return wpa_ctrl_command(ctrl, buf);
++}
+
+ static int hostapd_cli_cmd_disassoc_imminent(struct wpa_ctrl *ctrl, int argc,
+ char *argv[])
+@@ -1749,6 +1767,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ { "driver", hostapd_cli_cmd_driver, NULL,
+ "<driver sub command> [<hex formatted data>] = send driver command data" },
+ #endif /* ANDROID */
++ { "inband_discovery", hostapd_cli_cmd_inband_discovery, NULL,
++ "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
+ { NULL, NULL, NULL, NULL }
+ };
+
+diff --git a/src/ap/beacon.c b/src/ap/beacon.c
+index 814e86e..1a26f11 100644
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1497,6 +1497,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+ struct wpa_driver_ap_params *params)
+ {
+ params->fd_max_int = hapd->conf->fils_discovery_max_int;
++ params->unsol_bcast_probe_resp_interval =
++ hapd->conf->unsol_bcast_probe_resp_interval;
+ if (is_6ghz_op_class(hapd->iconf->op_class) &&
+ params->fd_max_int > FD_MAX_INTERVAL_6GHZ)
+ params->fd_max_int = FD_MAX_INTERVAL_6GHZ;
+@@ -1505,7 +1507,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+ if (params->fd_min_int > params->fd_max_int)
+ params->fd_min_int = params->fd_max_int;
+
+- if (params->fd_max_int)
++ if (params->fd_max_int || (is_6ghz_op_class(hapd->iconf->op_class) &&
++ !params->unsol_bcast_probe_resp_interval))
+ return hostapd_gen_fils_discovery(hapd,
+ ¶ms->fd_frame_tmpl_len);
+
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 53f2503..5eba0ea 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -4498,9 +4498,10 @@ static int nl80211_fils_discovery(struct i802_bss *bss, struct nl_msg *msg,
+ params->fd_max_int) ||
+ (params->fd_frame_tmpl &&
+ nla_put(msg, NL80211_FILS_DISCOVERY_ATTR_TMPL,
+- params->fd_frame_tmpl_len, params->fd_frame_tmpl)))
++ params->fd_frame_tmpl_len, params->fd_frame_tmpl)) ||
++ nla_put_u32(msg, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
++ params->unsol_bcast_probe_resp_interval))
+ return -1;
+-
+ nla_nest_end(msg, attr);
+ return 0;
+ }
+@@ -4844,7 +4845,10 @@ static int wpa_driver_nl80211_set_ap(void *priv,
+ #endif /* CONFIG_SAE */
+
+ #ifdef CONFIG_FILS
+- if (params->fd_max_int && nl80211_fils_discovery(bss, msg, params) < 0)
++ if ((params->fd_max_int ||
++ ((params->freq->freq > 5950 && params->freq->freq <= 7115) &&
++ !(params->unsol_bcast_probe_resp_interval))) &&
++ nl80211_fils_discovery(bss, msg, params) < 0)
+ goto fail;
+ #endif /* CONFIG_FILS */
+
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index 0568a79..c4bf3ad 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -7379,6 +7379,7 @@ enum nl80211_fils_discovery_attributes {
+ NL80211_FILS_DISCOVERY_ATTR_INT_MIN,
+ NL80211_FILS_DISCOVERY_ATTR_INT_MAX,
+ NL80211_FILS_DISCOVERY_ATTR_TMPL,
++ NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
+
+ /* keep last */
+ __NL80211_FILS_DISCOVERY_ATTR_LAST,
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99903-hostapd-mtk-Add-mtk_vendor.h.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99903-hostapd-mtk-Add-mtk_vendor.h.patch
new file mode 100644
index 0000000..a15287e
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99903-hostapd-mtk-Add-mtk_vendor.h.patch
@@ -0,0 +1,214 @@
+From e4b9b5847090d25009a4cf104052ba0490e95ffe Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Mon, 30 May 2022 15:04:57 +0800
+Subject: [PATCH 99903/99909] hostapd: mtk: Add mtk_vendor.h
+
+---
+ src/common/mtk_vendor.h | 195 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 195 insertions(+)
+ create mode 100644 src/common/mtk_vendor.h
+
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+new file mode 100644
+index 0000000..528387f
+--- /dev/null
++++ b/src/common/mtk_vendor.h
+@@ -0,0 +1,195 @@
++// SPDX-License-Identifier: ISC
++/* Copyright (C) 2020 Felix Fietkau <nbd@nbd.name> */
++#ifndef MTK_VENDOR_H
++#define MTK_VENDOR_H
++
++#define OUI_MTK 0x000ce7
++
++enum mtk_nl80211_vendor_subcmds {
++ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
++ MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
++ MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
++ MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++};
++
++enum mtk_vendor_attr_edcca_ctrl {
++ MTK_VENDOR_ATTR_EDCCA_THRESHOLD_INVALID = 0,
++
++ MTK_VENDOR_ATTR_EDCCA_CTRL_MODE,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
++};
++
++enum mtk_vendor_attr_edcca_ctrl_mode {
++ EDCCA_CTRL_SET_EN = 0,
++ EDCCA_CTRL_SET_THERS,
++ EDCCA_CTRL_GET_EN,
++ EDCCA_CTRL_GET_THERS,
++ EDCCA_CTRL_NUM,
++};
++
++static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
++};
++
++enum mtk_vendor_attr_csi_ctrl {
++ MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2,
++ MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR,
++ MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_DATA,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_CSI_CTRL,
++ MTK_VENDOR_ATTR_CSI_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_CSI_CTRL - 1
++};
++
++enum mtk_vendor_attr_csi_data {
++ MTK_VENDOR_ATTR_CSI_DATA_UNSPEC,
++ MTK_VENDOR_ATTR_CSI_DATA_PAD,
++
++ MTK_VENDOR_ATTR_CSI_DATA_VER,
++ MTK_VENDOR_ATTR_CSI_DATA_TS,
++ MTK_VENDOR_ATTR_CSI_DATA_RSSI,
++ MTK_VENDOR_ATTR_CSI_DATA_SNR,
++ MTK_VENDOR_ATTR_CSI_DATA_BW,
++ MTK_VENDOR_ATTR_CSI_DATA_CH_IDX,
++ MTK_VENDOR_ATTR_CSI_DATA_TA,
++ MTK_VENDOR_ATTR_CSI_DATA_I,
++ MTK_VENDOR_ATTR_CSI_DATA_Q,
++ MTK_VENDOR_ATTR_CSI_DATA_INFO,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD1,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD2,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD3,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD4,
++ MTK_VENDOR_ATTR_CSI_DATA_TX_ANT,
++ MTK_VENDOR_ATTR_CSI_DATA_RX_ANT,
++ MTK_VENDOR_ATTR_CSI_DATA_MODE,
++ MTK_VENDOR_ATTR_CSI_DATA_H_IDX,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_CSI_DATA,
++ MTK_VENDOR_ATTR_CSI_DATA_MAX =
++ NUM_MTK_VENDOR_ATTRS_CSI_DATA - 1
++};
++
++enum mtk_vendor_attr_mnt_ctrl {
++ MTK_VENDOR_ATTR_AMNT_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_CTRL_SET,
++ MTK_VENDOR_ATTR_AMNT_CTRL_DUMP,
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_CTRL,
++ MTK_VENDOR_ATTR_AMNT_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_CTRL - 1
++};
++
++enum mtk_vendor_attr_mnt_set {
++ MTK_VENDOR_ATTR_AMNT_SET_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_SET_INDEX,
++ MTK_VENDOR_ATTR_AMNT_SET_MACADDR,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_SET,
++ MTK_VENDOR_ATTR_AMNT_SET_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_SET - 1
++};
++
++enum mtk_vendor_attr_mnt_dump {
++ MTK_VENDOR_ATTR_AMNT_DUMP_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_DUMP_INDEX,
++ MTK_VENDOR_ATTR_AMNT_DUMP_LEN,
++ MTK_VENDOR_ATTR_AMNT_DUMP_RESULT,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_DUMP,
++ MTK_VENDOR_ATTR_AMNT_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_DUMP - 1
++};
++
++enum mtk_vendor_attr_wireless_ctrl {
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_OFDMA,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
++};
++
++enum mtk_vendor_attr_rfeature_ctrl {
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
++};
++
++#define CSI_MAX_COUNT 256
++#define ETH_ALEN 6
++
++struct csi_data {
++ s16 data_i[CSI_MAX_COUNT];
++ s16 data_q[CSI_MAX_COUNT];
++ s8 rssi;
++ u8 snr;
++ u32 ts;
++ u8 data_bw;
++ u8 pri_ch_idx;
++ u8 ta[ETH_ALEN];
++ u32 info;
++ u8 rx_mode;
++ u32 h_idx;
++ u16 tx_idx;
++ u16 rx_idx;
++};
++
++struct amnt_data {
++ u8 idx;
++ u8 addr[ETH_ALEN];
++ s8 rssi[4];
++ u32 last_seen;
++};
++#endif /* MTK_VENDOR_H */
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
new file mode 100644
index 0000000..40dded6
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
@@ -0,0 +1,619 @@
+From cef7f515eafeeaa99933cc9e66c79b705e3ab065 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Mon, 30 May 2022 16:31:34 +0800
+Subject: [PATCH 99904/99909] hostapd: mtk: Support EDCCA hostapd configuration
+
+edcca_enable and edcca_compensation and implement edcca related handlers.
+---
+ hostapd/config_file.c | 32 ++++++
+ hostapd/ctrl_iface.c | 125 ++++++++++++++++++++++
+ src/ap/ap_config.c | 4 +
+ src/ap/ap_config.h | 29 ++++++
+ src/ap/ap_drv_ops.c | 24 +++++
+ src/ap/ap_drv_ops.h | 5 +-
+ src/ap/hostapd.c | 7 ++
+ src/common/mtk_vendor.h | 19 ++--
+ src/drivers/driver.h | 4 +
+ src/drivers/driver_nl80211.c | 165 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 7 ++
+ 12 files changed, 415 insertions(+), 7 deletions(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index eda9db0..0ee8952 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4753,6 +4753,38 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ } else if (os_strcmp(buf, "eht_mu_beamformer") == 0) {
+ conf->eht_phy_capab.mu_beamformer = atoi(pos);
+ #endif /* CONFIG_IEEE80211BE */
++ } else if (os_strcmp(buf, "edcca_threshold") == 0) {
++ if (hostapd_parse_intlist(&conf->edcca_threshold, pos) ||
++ conf->edcca_threshold[0] < EDCCA_MIN_CONFIG_THRES ||
++ conf->edcca_threshold[0] > EDCCA_MAX_CONFIG_THRES ||
++ conf->edcca_threshold[1] < EDCCA_MIN_CONFIG_THRES ||
++ conf->edcca_threshold[1] > EDCCA_MAX_CONFIG_THRES ||
++ conf->edcca_threshold[2] < EDCCA_MIN_CONFIG_THRES ||
++ conf->edcca_threshold[2] > EDCCA_MAX_CONFIG_THRES) {
++ wpa_printf(MSG_ERROR, "Line %d: invalid edcca threshold",
++ line);
++ return 1;
++ }
++ } else if (os_strcmp(buf, "edcca_enable") == 0) {
++ int mode = atoi(pos);
++ if (mode < EDCCA_MODE_FORCE_DISABLE || mode > EDCCA_MODE_AUTO) {
++ wpa_printf(MSG_ERROR, "Line %d: Invalid edcca_enable %d;"
++ " allowed value 0 (Force Disable) or 1(Auto) ",
++ line, mode);
++ return 1;
++ }
++ conf->edcca_enable = (u8) mode;
++ } else if (os_strcmp(buf, "edcca_compensation") == 0) {
++ int val = atoi(pos);
++ if (val < EDCCA_MIN_COMPENSATION ||
++ val > EDCCA_MAX_COMPENSATION) {
++ wpa_printf(MSG_ERROR, "Line %d: Invalid compensation"
++ " value %d; allowed value %d ~ %d.",
++ line, val, EDCCA_MIN_COMPENSATION,
++ EDCCA_MAX_COMPENSATION);
++ return 1;
++ }
++ conf->edcca_compensation = (s8) val;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index bb8c74f..9c70d54 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -598,6 +598,19 @@ static const char * pbc_status_str(enum pbc_status status)
+ }
+
+
++static const char * edcca_mode_str(enum edcca_mode status)
++{
++ switch (status) {
++ case EDCCA_MODE_FORCE_DISABLE:
++ return "Force Disable";
++ case EDCCA_MODE_AUTO:
++ return "Auto";
++ default:
++ return "Unknown";
++ }
++}
++
++
+ static int hostapd_ctrl_iface_wps_get_status(struct hostapd_data *hapd,
+ char *buf, size_t buflen)
+ {
+@@ -3322,6 +3335,112 @@ static int hostapd_ctrl_iface_driver_cmd(struct hostapd_data *hapd, char *cmd,
+ #endif /* ANDROID */
+
+
++static int
++hostapd_ctrl_iface_set_edcca(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *pos, *config, *value;
++ config = cmd;
++ pos = os_strchr(config, ' ');
++ if (pos == NULL)
++ return -1;
++ *pos++ = '\0';
++
++ if(pos == NULL)
++ return -1;
++ value = pos;
++
++ if (os_strcmp(config, "enable") == 0) {
++ int mode = atoi(value);
++ if (mode < EDCCA_MODE_FORCE_DISABLE || mode > EDCCA_MODE_AUTO) {
++ wpa_printf(MSG_ERROR, "Invalid value for edcca enable");
++ return -1;
++ }
++ hapd->iconf->edcca_enable = (u8) mode;
++ if (hostapd_drv_configure_edcca_enable(hapd) != 0)
++ return -1;
++ } else if (os_strcmp(config, "compensation") == 0) {
++ int compensation = atoi(value);
++ if (compensation < EDCCA_MIN_COMPENSATION ||
++ compensation > EDCCA_MAX_COMPENSATION) {
++ wpa_printf(MSG_ERROR, "Invalid value for edcca compensation");
++ return -1;
++ }
++ hapd->iconf->edcca_compensation = (s8) compensation;
++ if (hostapd_drv_configure_edcca_enable(hapd) != 0)
++ return -1;
++ } else if (os_strcmp(config, "threshold") == 0) {
++ char *thres_value;
++ thres_value = os_strchr(value, ':');
++ if (thres_value == NULL)
++ return -1;
++ *thres_value++ = '\0';
++
++ if(thres_value == NULL)
++ return -1;
++ int bw_idx= atoi(value);
++ int threshold = atoi(thres_value);
++
++ if (bw_idx < EDCCA_BW_20 || bw_idx > EDCCA_BW_80) {
++ wpa_printf(MSG_ERROR,
++ "Unsupported Bandwidth idx %d for SET_EDCCA",
++ bw_idx);
++ return -1;
++ }
++ if (threshold < EDCCA_MIN_CONFIG_THRES ||
++ threshold > EDCCA_MAX_CONFIG_THRES) {
++ wpa_printf(MSG_ERROR,
++ "Unsupported threshold %d for SET_EDCCA",
++ threshold);
++ return -1;
++ }
++
++ int threshold_arr[EDCCA_MAX_BW_NUM];
++ /* 0x7f means keep the origival value in firmware */
++ os_memset(threshold_arr, 0x7f, sizeof(threshold_arr));
++ threshold_arr[bw_idx] = threshold;
++
++ if (hostapd_drv_configure_edcca_threshold(hapd, threshold_arr) != 0)
++ return -1;
++ } else {
++ wpa_printf(MSG_ERROR,
++ "Unsupported parameter %s for SET_EDCCA", config);
++ return -1;
++ }
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++
++static int
++hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
++ size_t buflen)
++{
++ char *pos, *end;
++
++ pos = buf;
++ end = buf + buflen;
++ u8 value[EDCCA_MAX_BW_NUM] = {0};
++
++ if (os_strcmp(cmd, "enable") == 0) {
++ return os_snprintf(pos, end - pos, "Enable: %s\n",
++ edcca_mode_str(hapd->iconf->edcca_enable));
++ } else if (os_strcmp(cmd, "compensation") == 0) {
++ return os_snprintf(pos, end - pos, "Compensation: %d\n",
++ hapd->iconf->edcca_compensation);
++ } else if (os_strcmp(cmd, "threshold") == 0) {
++ if (hostapd_drv_get_edcca(hapd, EDCCA_CTRL_GET_THRES, &value) != 0)
++ return -1;
++ return os_snprintf(pos, end - pos,
++ "Threshold BW20: 0x%x, BW40: 0x%x, BW80: 0x%x\n",
++ value[0], value[1], value[2]);
++ } else {
++ wpa_printf(MSG_ERROR,
++ "Unsupported parameter %s for GET_EDCCA", cmd);
++ return -1;
++ }
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -3868,6 +3987,12 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_len = hostapd_ctrl_iface_driver_cmd(hapd, buf + 7, reply,
+ reply_size);
+ #endif /* ANDROID */
++ } else if (os_strncmp(buf, "SET_EDCCA ", 10) == 0) {
++ reply_len = hostapd_ctrl_iface_set_edcca(hapd, buf+10, reply,
++ reply_size);
++ } else if (os_strncmp(buf, "GET_EDCCA ", 10) == 0) {
++ reply_len = hostapd_ctrl_iface_get_edcca(hapd, buf+10, reply,
++ reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 4a20eb4..344585a 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -294,6 +294,9 @@ struct hostapd_config * hostapd_config_defaults(void)
+ conf->airtime_update_interval = AIRTIME_DEFAULT_UPDATE_INTERVAL;
+ #endif /* CONFIG_AIRTIME_POLICY */
+
++ conf->edcca_enable = EDCCA_MODE_AUTO;
++ conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
++
+ return conf;
+ }
+
+@@ -1007,6 +1010,7 @@ void hostapd_config_free(struct hostapd_config *conf)
+ #ifdef CONFIG_ACS
+ os_free(conf->acs_chan_bias);
+ #endif /* CONFIG_ACS */
++ os_free(conf->edcca_threshold);
+ wpabuf_free(conf->lci);
+ wpabuf_free(conf->civic);
+
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 3f68e76..775c567 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1153,8 +1153,37 @@ struct hostapd_config {
+ #define CH_SWITCH_EHT_ENABLED BIT(0)
+ #define CH_SWITCH_EHT_DISABLED BIT(1)
+ unsigned int ch_switch_eht_config;
++ u8 edcca_enable;
++ s8 edcca_compensation;
++ int *edcca_threshold;
+ };
+
++enum edcca_mode {
++ EDCCA_MODE_FORCE_DISABLE = 0,
++ EDCCA_MODE_AUTO = 1,
++};
++
++enum edcca_bw_id {
++ EDCCA_BW_20 = 0,
++ EDCCA_BW_40,
++ EDCCA_BW_80,
++ EDCCA_MAX_BW_NUM,
++};
++
++enum mtk_vendor_attr_edcca_ctrl_mode {
++ EDCCA_CTRL_SET_EN = 0,
++ EDCCA_CTRL_SET_THRES,
++ EDCCA_CTRL_GET_EN,
++ EDCCA_CTRL_GET_THRES,
++ EDCCA_CTRL_NUM,
++};
++
++#define EDCCA_DEFAULT_COMPENSATION -6
++#define EDCCA_MIN_COMPENSATION -126
++#define EDCCA_MAX_COMPENSATION 126
++#define EDCCA_MIN_CONFIG_THRES -126
++#define EDCCA_MAX_CONFIG_THRES 0
++
+
+ static inline enum oper_chan_width
+ hostapd_get_oper_chwidth(struct hostapd_config *conf)
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 0c7aee2..25e967d 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1015,3 +1015,27 @@ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable)
+ return 0;
+ return hapd->driver->dpp_listen(hapd->drv_priv, enable);
+ }
++
++int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->configure_edcca_enable)
++ return 0;
++ return hapd->driver->configure_edcca_enable(hapd->drv_priv,
++ hapd->iconf->edcca_enable,
++ hapd->iconf->edcca_compensation);
++}
++
++int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
++ const int *threshold)
++{
++ if (!hapd->driver || !hapd->driver->configure_edcca_threshold)
++ return 0;
++ return hapd->driver->configure_edcca_threshold(hapd->drv_priv, threshold);
++}
++
++int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
++{
++ if (!hapd->driver || !hapd->driver->get_edcca)
++ return 0;
++ return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index b4fb766..70a99f4 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -138,7 +138,10 @@ int hostapd_drv_do_acs(struct hostapd_data *hapd);
+ int hostapd_drv_update_dh_ie(struct hostapd_data *hapd, const u8 *peer,
+ u16 reason_code, const u8 *ie, size_t ielen);
+ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable);
+-
++int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
++int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
++ const int *threshold);
++int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 0dd8c13..d05f948 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2295,6 +2295,13 @@ dfs_offload:
+ }
+ #endif /* CONFIG_MESH */
+
++ if (hostapd_drv_configure_edcca_enable(hapd) < 0)
++ goto fail;
++
++ if (hostapd_drv_configure_edcca_threshold(hapd,
++ hapd->iconf->edcca_threshold) < 0)
++ goto fail;
++
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+ if (iface->interfaces && iface->interfaces->terminate_on_error > 0)
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 528387f..7056126 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -29,14 +29,21 @@ enum mtk_vendor_attr_edcca_ctrl {
+ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
+ };
+
+-enum mtk_vendor_attr_edcca_ctrl_mode {
+- EDCCA_CTRL_SET_EN = 0,
+- EDCCA_CTRL_SET_THERS,
+- EDCCA_CTRL_GET_EN,
+- EDCCA_CTRL_GET_THERS,
+- EDCCA_CTRL_NUM,
++enum mtk_vendor_attr_edcca_dump {
++ MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
++
++ MTK_VENDOR_ATTR_EDCCA_DUMP_MODE,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
+ };
+
++
+ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+ [MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
+ [MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 1d2b1b2..3559974 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4676,6 +4676,10 @@ struct wpa_driver_ops {
+ const u8 *match, size_t match_len,
+ bool multicast);
+ #endif /* CONFIG_TESTING_OPTIONS */
++ int (*configure_edcca_enable)(void *priv, const u8 edcca_enable,
++ const s8 edcca_compensation);
++ int (*configure_edcca_threshold)(void *priv, const int *threshold);
++ int (*get_edcca)(void *priv, const u8 mode, u8 *value);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 5eba0ea..9c2782c 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -35,6 +35,8 @@
+ #include "radiotap_iter.h"
+ #include "rfkill.h"
+ #include "driver_nl80211.h"
++#include "common/mtk_vendor.h"
++#include "ap/ap_config.h"
+
+
+ #ifndef NETLINK_CAP_ACK
+@@ -12368,6 +12370,165 @@ static int testing_nl80211_radio_disable(void *priv, int disabled)
+
+ #endif /* CONFIG_TESTING_OPTIONS */
+
++static int nl80211_configure_edcca_enable(void *priv,
++ const u8 edcca_enable,
++ const s8 edcca_compensation)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_edcca_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting EDCCA enable");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, EDCCA_CTRL_SET_EN) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL, edcca_enable) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
++ edcca_compensation)) {
++ wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to configure EDCCA enable. ret=%d (%s) ",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
++
++static int nl80211_configure_edcca_threshold(void *priv, const int *threshold)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_edcca_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting EDCCA threshold");
++ return 0;
++ }
++
++ if (!threshold) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Input EDCCA threshold is empty!");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, EDCCA_CTRL_SET_THRES) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL, threshold[0] & 0xff) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL, threshold[1] & 0xff) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL, threshold[2] & 0xff)) {
++ wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to configure EDCCA threshold. ret=%d (%s) ",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
++
++
++static int edcca_info_handler(struct nl_msg *msg, void *arg)
++{
++ u8 *info = (u8*) arg;
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_MAX + 1];
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct nlattr *nl_vend, *attr;
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!nl_vend)
++ return NL_SKIP;
++
++ nla_parse(tb_vendor, MTK_VENDOR_ATTR_EDCCA_DUMP_MAX,
++ nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL");
++ return NL_SKIP;
++ }
++
++ *info++ = nla_get_u8(attr);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL");
++ return NL_SKIP;
++ }
++
++ *info++ = nla_get_u8(attr);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL");
++ return NL_SKIP;
++ }
++
++ *info = nla_get_u8(attr);
++ return NL_SKIP;
++}
++
++
++static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_edcca_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting EDCCA threshold");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, mode)) {
++ wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, edcca_info_handler, value, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to get EDCCA configuration. ret=%d (%s)",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
++
+
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+@@ -12514,4 +12675,8 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .register_frame = testing_nl80211_register_frame,
+ .radio_disable = testing_nl80211_radio_disable,
+ #endif /* CONFIG_TESTING_OPTIONS */
++/* Need ifdef CONFIG_DRIVER_NL80211_MTK */
++ .configure_edcca_enable = nl80211_configure_edcca_enable,
++ .configure_edcca_threshold = nl80211_configure_edcca_threshold,
++ .get_edcca = nl80211_get_edcca,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 6e40d55..13e5d24 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -181,6 +181,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int qca_do_acs:1;
+ unsigned int brcm_do_acs:1;
+ unsigned int uses_6ghz:1;
++ unsigned int mtk_edcca_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 7ede0d0..732ae29 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -18,6 +18,7 @@
+ #include "common/qca-vendor-attr.h"
+ #include "common/brcm_vendor.h"
+ #include "driver_nl80211.h"
++#include "common/mtk_vendor.h"
+
+
+ static int protocol_feature_handler(struct nl_msg *msg, void *arg)
+@@ -1050,6 +1051,12 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ break;
+ }
+ #endif /* CONFIG_DRIVER_NL80211_BRCM */
++ } else if (vinfo->vendor_id == OUI_MTK) {
++ switch (vinfo->subcmd) {
++ case MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL :
++ drv->mtk_edcca_vendor_cmd_avail = 1;
++ break;
++ }
+ }
+
+ wpa_printf(MSG_DEBUG, "nl80211: Supported vendor command: vendor_id=0x%x subcmd=%u",
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
new file mode 100644
index 0000000..18617be
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
@@ -0,0 +1,450 @@
+From a288f97e708bc579e285b509f7c0655c2f27a76c Mon Sep 17 00:00:00 2001
+From: TomLiu <tomml.liu@mediatek.com>
+Date: Tue, 9 Aug 2022 10:23:44 -0700
+Subject: [PATCH 99905/99909] hostapd: mtk: Add hostapd HEMU SET/GET control
+
+---
+ hostapd/config_file.c | 9 +++
+ hostapd/ctrl_iface.c | 62 +++++++++++++++++
+ hostapd/hostapd_cli.c | 18 +++++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 1 +
+ src/ap/ap_drv_ops.c | 14 ++++
+ src/ap/ap_drv_ops.h | 2 +
+ src/ap/hostapd.c | 2 +
+ src/common/mtk_vendor.h | 15 ++++
+ src/drivers/driver.h | 13 ++++
+ src/drivers/driver_nl80211.c | 110 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 3 +
+ 13 files changed, 251 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 0ee8952..b22d10b 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3659,6 +3659,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ return 1;
+ }
+ bss->unsol_bcast_probe_resp_interval = val;
++ } else if (os_strcmp(buf, "hemu_onoff") == 0) {
++ int val = atoi(pos);
++ if (val < 0 || val > 15) {
++ wpa_printf(MSG_ERROR,
++ "Line %d: invalid hemu_onoff value",
++ line);
++ return 1;
++ }
++ conf->hemu_onoff = val;
+ #endif /* CONFIG_IEEE80211AX */
+ } else if (os_strcmp(buf, "max_listen_interval") == 0) {
+ bss->max_listen_interval = atoi(pos);
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 9c70d54..5f71aee 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3441,6 +3441,63 @@ hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
+ }
+
+
++static int
++hostapd_ctrl_iface_set_hemu(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *pos, *config, *value;
++ config = cmd;
++ pos = os_strchr(config, ' ');
++ if (pos == NULL)
++ return -1;
++ *pos++ = '\0';
++
++ if(pos == NULL)
++ return -1;
++ value = pos;
++
++ if (os_strcmp(config, "onoff") == 0) {
++ int hemu = atoi(value);
++ if (hemu < 0 || hemu > 15) {
++ wpa_printf(MSG_ERROR, "Invalid value for hemu");
++ return -1;
++ }
++ hapd->iconf->hemu_onoff = (u8) hemu;
++ } else {
++ wpa_printf(MSG_ERROR,
++ "Unsupported parameter %s for SET_HEMU", config);
++ return -1;
++ }
++
++ if(hostapd_drv_hemu_ctrl(hapd) == 0) {
++ return os_snprintf(buf, buflen, "OK\n");
++ } else {
++ return -1;
++ }
++}
++
++
++static int
++hostapd_ctrl_iface_get_hemu(struct hostapd_data *hapd, char *buf,
++ size_t buflen)
++{
++ u8 hemu_onoff;
++ char *pos, *end;
++
++ pos = buf;
++ end = buf + buflen;
++
++ if (hostapd_drv_hemu_dump(hapd, &hemu_onoff) == 0) {
++ hapd->iconf->hemu_onoff = hemu_onoff;
++ return os_snprintf(pos, end - pos, "[hostapd_cli] = UL MU-MIMO: %d, DL MU-MIMO: %d, UL OFDMA: %d, DL OFDMA: %d\n",
++ !!(hemu_onoff&BIT(3)), !!(hemu_onoff&BIT(2)), !!(hemu_onoff&BIT(1)), !!(hemu_onoff&BIT(0)));
++ } else {
++ wpa_printf(MSG_INFO, "ctrl iface failed to call");
++ return -1;
++ }
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -3993,6 +4050,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ } else if (os_strncmp(buf, "GET_EDCCA ", 10) == 0) {
+ reply_len = hostapd_ctrl_iface_get_edcca(hapd, buf+10, reply,
+ reply_size);
++ } else if (os_strncmp(buf, "SET_HEMU ", 9) == 0) {
++ reply_len = hostapd_ctrl_iface_set_hemu(hapd, buf+9, reply,
++ reply_size);
++ } else if (os_strncmp(buf, "GET_HEMU", 8) == 0) {
++ reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index db21258..0d36477 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1380,6 +1380,20 @@ static int hostapd_cli_cmd_driver_flags(struct wpa_ctrl *ctrl, int argc,
+ }
+
+
++static int hostapd_cli_cmd_set_hemu(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "SET_HEMU", 1, argc, argv);
++}
++
++
++static int hostapd_cli_cmd_get_hemu(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "GET_HEMU", 0, NULL, NULL);
++}
++
++
+ #ifdef CONFIG_DPP
+
+ static int hostapd_cli_cmd_dpp_qr_code(struct wpa_ctrl *ctrl, int argc,
+@@ -1705,6 +1719,10 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ " = send FTM range request"},
+ { "driver_flags", hostapd_cli_cmd_driver_flags, NULL,
+ " = show supported driver flags"},
++ { "set_hemu", hostapd_cli_cmd_set_hemu, NULL,
++ "<value> [0-15] bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0)"},
++ { "get_hemu", hostapd_cli_cmd_get_hemu, NULL,
++ " = show hemu onoff value in 0-15 bitmap"},
+ #ifdef CONFIG_DPP
+ { "dpp_qr_code", hostapd_cli_cmd_dpp_qr_code, NULL,
+ "report a scanned DPP URI from a QR Code" },
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 344585a..0e1f192 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -280,6 +280,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ conf->he_6ghz_max_ampdu_len_exp = 7;
+ conf->he_6ghz_rx_ant_pat = 1;
+ conf->he_6ghz_tx_ant_pat = 1;
++ conf->hemu_onoff = 13;
+ #endif /* CONFIG_IEEE80211AX */
+
+ /* The third octet of the country string uses an ASCII space character
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 775c567..41b8c68 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1114,6 +1114,7 @@ struct hostapd_config {
+ u8 he_6ghz_rx_ant_pat;
+ u8 he_6ghz_tx_ant_pat;
+ u8 he_6ghz_reg_pwr_type;
++ u8 hemu_onoff;
+ #endif /* CONFIG_IEEE80211AX */
+
+ /* VHT enable/disable config from CHAN_SWITCH */
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 25e967d..4598737 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1039,3 +1039,17 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
+ return 0;
+ return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
+ }
++
++int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->hemu_ctrl)
++ return 0;
++ return hapd->driver->hemu_ctrl(hapd->drv_priv, hapd->iconf->hemu_onoff);
++}
++
++int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
++{
++ if (!hapd->driver || !hapd->driver->hemu_dump)
++ return 0;
++ return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 70a99f4..bca39c5 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -142,6 +142,8 @@ int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
+ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
+ const int *threshold);
+ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
++int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index d05f948..921769d 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2301,6 +2301,8 @@ dfs_offload:
+ if (hostapd_drv_configure_edcca_threshold(hapd,
+ hapd->iconf->edcca_threshold) < 0)
+ goto fail;
++ if (hostapd_drv_hemu_ctrl(hapd) < 0)
++ goto fail;
+
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 7056126..69a46df 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -10,6 +10,8 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
+ MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
+ MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
++ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
+ };
+
+@@ -174,6 +176,19 @@ enum mtk_vendor_attr_rfeature_ctrl {
+ NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
+ };
+
++enum mtk_vendor_attr_hemu_ctrl {
++ MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
++ MTK_VENDOR_ATTR_HEMU_CTRL_DUMP,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
++ MTK_VENDOR_ATTR_HEMU_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
++};
++
++
+ #define CSI_MAX_COUNT 256
+ #define ETH_ALEN 6
+
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 3559974..4cd7505 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1623,6 +1623,11 @@ struct wpa_driver_ap_params {
+ * Unsolicited broadcast Probe Response template length
+ */
+ size_t unsol_bcast_probe_resp_tmpl_len;
++
++ /**
++ * hemu onoff=<val> (bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0))
++ */
++ u8 hemu_onoff;
+ };
+
+ struct wpa_driver_mesh_bss_params {
+@@ -4680,6 +4685,14 @@ struct wpa_driver_ops {
+ const s8 edcca_compensation);
+ int (*configure_edcca_threshold)(void *priv, const int *threshold);
+ int (*get_edcca)(void *priv, const u8 mode, u8 *value);
++
++ /**
++ * hemu_ctrl - ctrl on off for UL/DL MURU
++ * @priv: Private driver interface data
++ *
++ */
++ int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
++ int (*hemu_dump)(void *priv, u8 *hemu_onoff);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 9c2782c..73dee2e 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12304,6 +12304,114 @@ fail:
+ }
+
+
++#ifdef CONFIG_IEEE80211AX
++static int nl80211_hemu_muruonoff(void *priv, u8 hemu_onoff)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_hemu_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting hemu control");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF, hemu_onoff)) {
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if(ret){
++ wpa_printf(MSG_ERROR, "Failed to set hemu_onoff. ret=%d (%s)", ret, strerror(-ret));
++ }
++ return ret;
++}
++
++
++static int hemu_dump_handler(struct nl_msg *msg, void *arg)
++{
++ u8 *hemu_onoff = (u8 *) arg;
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb_vendor[MTK_VENDOR_ATTR_HEMU_CTRL_MAX + 1];
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct nlattr *nl_vend, *attr;
++
++ static const struct nla_policy
++ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL + 1] = {
++ [MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_HEMU_CTRL_DUMP] = {.type = NLA_U8 },
++ };
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!nl_vend)
++ return NL_SKIP;
++
++ nla_parse(tb_vendor, MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
++ nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: cannot find MTK_VENDOR_ATTR_HEMU_CTRL_DUMP");
++ return NL_SKIP;
++ }
++
++ *hemu_onoff = nla_get_u8(attr);
++ wpa_printf(MSG_DEBUG, "nla_get hemu_onoff: %d\n", *hemu_onoff);
++
++ return 0;
++}
++
++static int nl80211_hemu_dump(void *priv, u8 *hemu_onoff)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *attr;
++ int ret;
++
++ if (!drv->mtk_hemu_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting hemu control");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL)) {
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++
++ attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++ if (!attr) {
++ nlmsg_free(msg);
++ return -1;
++ }
++
++ nla_nest_end(msg, attr);
++
++ ret = send_and_recv_msgs(drv, msg, hemu_dump_handler, hemu_onoff, NULL, NULL);
++
++ if(ret){
++ wpa_printf(MSG_ERROR, "Failed to get hemu_onoff. ret=%d (%s)", ret, strerror(-ret));
++ }
++
++ return ret;
++}
++#endif /* CONFIG_IEEE80211AX */
++
++
+ #ifdef CONFIG_DPP
+ static int nl80211_dpp_listen(void *priv, bool enable)
+ {
+@@ -12668,6 +12776,8 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .update_connect_params = nl80211_update_connection_params,
+ .send_external_auth_status = nl80211_send_external_auth_status,
+ .set_4addr_mode = nl80211_set_4addr_mode,
++ .hemu_ctrl = nl80211_hemu_muruonoff,
++ .hemu_dump = nl80211_hemu_dump,
+ #ifdef CONFIG_DPP
+ .dpp_listen = nl80211_dpp_listen,
+ #endif /* CONFIG_DPP */
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 13e5d24..57f0249 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -182,6 +182,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int brcm_do_acs:1;
+ unsigned int uses_6ghz:1;
+ unsigned int mtk_edcca_vendor_cmd_avail:1;
++ unsigned int mtk_hemu_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 732ae29..cc146d9 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1056,6 +1056,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ case MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL :
+ drv->mtk_edcca_vendor_cmd_avail = 1;
+ break;
++ case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
++ drv->mtk_hemu_vendor_cmd_avail = 1;
++ break;
+ }
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
new file mode 100644
index 0000000..fc81ed1
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
@@ -0,0 +1,247 @@
+From 26c6be11e7597490ccc4d7704542c78dec6c4cd1 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 2 Sep 2022 01:03:23 +0800
+Subject: [PATCH 99906/99909] hostapd: mtk: Add three wire PTA ctrl hostapd
+ vendor command
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c | 4 ++++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 13 ++++++++++++
+ src/ap/ap_drv_ops.c | 11 +++++++++++
+ src/ap/ap_drv_ops.h | 1 +
+ src/ap/hostapd.c | 2 ++
+ src/common/mtk_vendor.h | 16 +++++++++++++++
+ src/drivers/driver.h | 8 ++++++++
+ src/drivers/driver_nl80211.c | 33 +++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 3 +++
+ 11 files changed, 93 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index b22d10b..18b372a 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4794,6 +4794,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ return 1;
+ }
+ conf->edcca_compensation = (s8) val;
++ } else if (os_strcmp(buf, "three_wire_enable") == 0) {
++ u8 en = atoi(pos);
++
++ conf->three_wire_enable = en;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 0e1f192..9249a6b 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -297,6 +297,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+
+ conf->edcca_enable = EDCCA_MODE_AUTO;
+ conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
++ conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
+
+ return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 41b8c68..71cf515 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1157,6 +1157,19 @@ struct hostapd_config {
+ u8 edcca_enable;
+ s8 edcca_compensation;
+ int *edcca_threshold;
++ u8 three_wire_enable;
++};
++
++enum three_wire_mode {
++ THREE_WIRE_MODE_DISABLE,
++ THREE_WIRE_MODE_EXT0_ENABLE,
++ THREE_WIRE_MODE_EXT1_ENABLE,
++ THREE_WIRE_MODE_ALL_ENABLE,
++
++ /* keep last */
++ NUM_THREE_WIRE_MODE,
++ THREE_WIRE_MODE_MAX =
++ NUM_THREE_WIRE_MODE - 1
+ };
+
+ enum edcca_mode {
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 4598737..a1d83e4 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1053,3 +1053,14 @@ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
+ return 0;
+ return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
+ }
++
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->three_wire_ctrl)
++ return 0;
++ if (hapd->iconf->three_wire_enable > THREE_WIRE_MODE_MAX) {
++ wpa_printf(MSG_INFO, "Invalid value for three wire enable\n");
++ return 0;
++ }
++ return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index bca39c5..5ba6297 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -144,6 +144,7 @@ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
+ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+ int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 921769d..f9dabdf 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2303,6 +2303,8 @@ dfs_offload:
+ goto fail;
+ if (hostapd_drv_hemu_ctrl(hapd) < 0)
+ goto fail;
++ if (hostapd_drv_three_wire_ctrl(hapd) < 0)
++ goto fail;
+
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 69a46df..ee5a4f4 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++ MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
+ };
+
+ enum mtk_vendor_attr_edcca_ctrl {
+@@ -55,6 +56,21 @@ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+ [MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
+ };
+
++enum mtk_vendor_attr_3wire_ctrl {
++ MTK_VENDOR_ATTR_3WIRE_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_3WIRE_CTRL_MODE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL,
++ MTK_VENDOR_ATTR_3WIRE_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL - 1
++};
++
++static struct nla_policy three_wire_ctrl_policy[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL] = {
++ [MTK_VENDOR_ATTR_3WIRE_CTRL_MODE] = {.type = NLA_U8 },
++};
++
+ enum mtk_vendor_attr_csi_ctrl {
+ MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
+
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 4cd7505..9ca19af 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4693,6 +4693,14 @@ struct wpa_driver_ops {
+ */
+ int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
+ int (*hemu_dump)(void *priv, u8 *hemu_onoff);
++
++ /**
++ * three_wire_ctrl - set three_wire_ctrl mode
++ * @priv: Private driver interface data
++ * @three_wire_enable: three_wire_ctrl mode
++ *
++ */
++ int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 73dee2e..2bb8cc2 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12637,6 +12637,38 @@ static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
+ return ret;
+ }
+
++static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ /* Prepare nl80211 cmd */
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_3wire_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting three wire control");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_3WIRE_CTRL_MODE, three_wire_enable)) {
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to enable three wire. ret=%d (%s) ",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
+
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+@@ -12789,4 +12821,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .configure_edcca_enable = nl80211_configure_edcca_enable,
+ .configure_edcca_threshold = nl80211_configure_edcca_threshold,
+ .get_edcca = nl80211_get_edcca,
++ .three_wire_ctrl = nl80211_enable_three_wire,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 57f0249..9fe7811 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -183,6 +183,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int uses_6ghz:1;
+ unsigned int mtk_edcca_vendor_cmd_avail:1;
+ unsigned int mtk_hemu_vendor_cmd_avail:1;
++ unsigned int mtk_3wire_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index cc146d9..04bc54e 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1059,6 +1059,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
+ drv->mtk_hemu_vendor_cmd_avail = 1;
+ break;
++ case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
++ drv->mtk_3wire_vendor_cmd_avail = 1;
++ break;
+ }
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99907-hostapd-mtk-Add-hostapd-iBF-control.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
new file mode 100644
index 0000000..50a08ba
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
@@ -0,0 +1,431 @@
+From 1f60afd21c6dd7dfe3d504dee7507654a981033b Mon Sep 17 00:00:00 2001
+From: mtk27835 <shurong.wen@mediatek.com>
+Date: Wed, 7 Sep 2022 14:41:51 -0700
+Subject: [PATCH 99907/99909] hostapd: mtk: Add hostapd iBF control
+
+Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
+---
+ hostapd/config_file.c | 3 +
+ hostapd/ctrl_iface.c | 26 +++++++
+ hostapd/hostapd_cli.c | 9 +++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 2 +
+ src/ap/ap_drv_ops.c | 14 ++++
+ src/ap/ap_drv_ops.h | 2 +
+ src/ap/hostapd.c | 2 +
+ src/common/mtk_vendor.h | 35 +++++++++-
+ src/drivers/driver.h | 19 ++++++
+ src/drivers/driver_nl80211.c | 108 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 3 +
+ 13 files changed, 224 insertions(+), 1 deletion(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 18b372a..d9d882c 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4798,6 +4798,9 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ u8 en = atoi(pos);
+
+ conf->three_wire_enable = en;
++ } else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
++ int val = atoi(pos);
++ conf->ibf_enable = !!val;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 5f71aee..c881d37 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3498,6 +3498,30 @@ hostapd_ctrl_iface_get_hemu(struct hostapd_data *hapd, char *buf,
+ }
+
+
++static int
++hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
++ size_t buflen)
++{
++ u8 ibf_enable;
++ int ret;
++ char *pos, *end;
++
++ pos = buf;
++ end = buf + buflen;
++
++ if (hostapd_drv_ibf_dump(hapd, &ibf_enable) == 0) {
++ hapd->iconf->ibf_enable = ibf_enable;
++ ret = os_snprintf(pos, end - pos, "ibf_enable: %u\n",
++ ibf_enable);
++ }
++
++ if (os_snprintf_error(end - pos, ret))
++ return 0;
++
++ return ret;
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -4055,6 +4079,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_size);
+ } else if (os_strncmp(buf, "GET_HEMU", 8) == 0) {
+ reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
++ } else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
++ reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 0d36477..c2a123a 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1586,6 +1586,13 @@ static int hostapd_cli_cmd_driver(struct wpa_ctrl *ctrl, int argc, char *argv[])
+ #endif /* ANDROID */
+
+
++static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "GET_IBF", 0, NULL, NULL);
++}
++
++
+ struct hostapd_cli_cmd {
+ const char *cmd;
+ int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
+@@ -1787,6 +1794,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ #endif /* ANDROID */
+ { "inband_discovery", hostapd_cli_cmd_inband_discovery, NULL,
+ "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
++ { "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
++ " = show iBF state (enabled/disabled)"},
+ { NULL, NULL, NULL, NULL }
+ };
+
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 9249a6b..7a96cb8 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -298,6 +298,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ conf->edcca_enable = EDCCA_MODE_AUTO;
+ conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
+ conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
++ conf->ibf_enable = IBF_DEFAULT_ENABLE;
+
+ return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 71cf515..44a0e7e 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1158,6 +1158,7 @@ struct hostapd_config {
+ s8 edcca_compensation;
+ int *edcca_threshold;
+ u8 three_wire_enable;
++ u8 ibf_enable;
+ };
+
+ enum three_wire_mode {
+@@ -1198,6 +1199,7 @@ enum mtk_vendor_attr_edcca_ctrl_mode {
+ #define EDCCA_MIN_CONFIG_THRES -126
+ #define EDCCA_MAX_CONFIG_THRES 0
+
++#define IBF_DEFAULT_ENABLE 0
+
+ static inline enum oper_chan_width
+ hostapd_get_oper_chwidth(struct hostapd_config *conf)
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index a1d83e4..60ae825 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1064,3 +1064,17 @@ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
+ }
+ return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
+ }
++
++int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->ibf_ctrl)
++ return 0;
++ return hapd->driver->ibf_ctrl(hapd->drv_priv, hapd->iconf->ibf_enable);
++}
++
++int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
++{
++ if (!hapd->driver || !hapd->driver->ibf_dump)
++ return 0;
++ return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
++}
+\ No newline at end of file
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 5ba6297..ab9aedc 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -145,6 +145,8 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+ int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index f9dabdf..e44b73d 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2305,6 +2305,8 @@ dfs_offload:
+ goto fail;
+ if (hostapd_drv_three_wire_ctrl(hapd) < 0)
+ goto fail;
++ if (hostapd_drv_ibf_ctrl(hapd) < 0)
++ goto fail;
+
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index ee5a4f4..4050cf8 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -13,7 +13,8 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
+- MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
++ MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
++ MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
+ };
+
+ enum mtk_vendor_attr_edcca_ctrl {
+@@ -204,6 +205,38 @@ enum mtk_vendor_attr_hemu_ctrl {
+ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
+ };
+
++enum mtk_vendor_attr_ibf_ctrl {
++ MTK_VENDOR_ATTR_IBF_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_IBF_CTRL_ENABLE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_IBF_CTRL,
++ MTK_VENDOR_ATTR_IBF_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_IBF_CTRL - 1
++};
++
++enum mtk_vendor_attr_ibf_dump {
++ MTK_VENDOR_ATTR_IBF_DUMP_UNSPEC,
++
++ MTK_VENDOR_ATTR_IBF_DUMP_ENABLE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_IBF_DUMP,
++ MTK_VENDOR_ATTR_IBF_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_IBF_DUMP - 1
++};
++
++static struct nla_policy
++ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
++ [MTK_VENDOR_ATTR_IBF_CTRL_ENABLE] = { .type = NLA_U8 },
++};
++
++static struct nla_policy
++ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
++ [MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
++};
++
+
+ #define CSI_MAX_COUNT 256
+ #define ETH_ALEN 6
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 9ca19af..71ded61 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1628,6 +1628,11 @@ struct wpa_driver_ap_params {
+ * hemu onoff=<val> (bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0))
+ */
+ u8 hemu_onoff;
++
++ /**
++ * ibf_enable=<val>
++ */
++ u8 ibf_enable;
+ };
+
+ struct wpa_driver_mesh_bss_params {
+@@ -4701,6 +4706,20 @@ struct wpa_driver_ops {
+ *
+ */
+ int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
++
++ /**
++ * ibf_ctrl - ctrl disable/enable for ibf
++ * @priv: Private driver interface data
++ *
++ */
++ int (*ibf_ctrl)(void *priv, u8 ibf_enable);
++
++ /**
++ * ibf_dump - dump ibf
++ * @priv: Private driver interface data
++ *
++ */
++ int (*ibf_dump)(void *priv, u8 *ibf_enable);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 2bb8cc2..e974f85 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12670,6 +12670,112 @@ static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
+ return ret;
+ }
+
++static int nl80211_ibf_enable(void *priv, u8 ibf_enable)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_ibf_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting ibf control");
++ return 0;
++ }
++
++ msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++ if (!data)
++ goto fail;
++
++ nla_put_u8(msg, MTK_VENDOR_ATTR_IBF_CTRL_ENABLE, ibf_enable);
++
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to set ibf_enable. ret=%d (%s)", ret, strerror(-ret));
++ }
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++}
++
++static int ibf_dump_handler(struct nl_msg *msg, void *arg)
++{
++ u8 *ibf_enable = (u8 *) arg;
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb_vendor[MTK_VENDOR_ATTR_IBF_DUMP_MAX + 1];
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct nlattr *nl_vend, *attr;
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!nl_vend)
++ return NL_SKIP;
++
++ nla_parse(tb_vendor, MTK_VENDOR_ATTR_IBF_DUMP_MAX,
++ nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: cannot find MTK_VENDOR_ATTR_IBF_DUMP_ENABLE");
++ return NL_SKIP;
++ }
++
++ *ibf_enable = nla_get_u8(attr);
++
++ return NL_SKIP;
++}
++
++static int
++nl80211_ibf_dump(void *priv, u8 *ibf_enable)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
++ if (!data)
++ goto fail;
++
++ nla_nest_end(msg, data);
++
++ ret = send_and_recv_msgs(drv, msg, ibf_dump_handler, ibf_enable, NULL, NULL);
++
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to dump ibf_enable. ret=%d (%s)", ret, strerror(-ret));
++ }
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+ .desc = "Linux nl80211/cfg80211",
+@@ -12822,4 +12928,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .configure_edcca_threshold = nl80211_configure_edcca_threshold,
+ .get_edcca = nl80211_get_edcca,
+ .three_wire_ctrl = nl80211_enable_three_wire,
++ .ibf_ctrl = nl80211_ibf_enable,
++ .ibf_dump = nl80211_ibf_dump,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 9fe7811..607592c 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -184,6 +184,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int mtk_edcca_vendor_cmd_avail:1;
+ unsigned int mtk_hemu_vendor_cmd_avail:1;
+ unsigned int mtk_3wire_vendor_cmd_avail:1;
++ unsigned int mtk_ibf_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 04bc54e..9ecc0ff 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1062,6 +1062,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
+ drv->mtk_3wire_vendor_cmd_avail = 1;
+ break;
++ case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
++ drv->mtk_ibf_vendor_cmd_avail = 1;
++ break;
+ }
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
new file mode 100644
index 0000000..9b96d98
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
@@ -0,0 +1,27 @@
+From 28228a96980512f30c8c8aac0f819c36f7241b68 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 22 Sep 2022 16:08:09 +0800
+Subject: [PATCH 99908/99909] hostapd: mtk: Do not include HE capab IE if
+ associated sta's HE capab IE is invalid
+
+---
+ src/ap/ieee802_11.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
+index d921783..098793e 100644
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -5192,7 +5192,8 @@ static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
+ #endif /* CONFIG_IEEE80211AC */
+
+ #ifdef CONFIG_IEEE80211AX
+- if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax) {
++ if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax &&
++ sta->flags & WLAN_STA_HE) {
+ p = hostapd_eid_he_capab(hapd, p, IEEE80211_MODE_AP);
+ p = hostapd_eid_he_operation(hapd, p);
+ p = hostapd_eid_cca(hapd, p);
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
new file mode 100644
index 0000000..8da9b5f
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
@@ -0,0 +1,376 @@
+From 737d21c64ab0ac49e9cce7185f1f79bb0b71f50e Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 7 Oct 2022 10:46:29 +0800
+Subject: [PATCH 99909/99909] hostapd: mtk: Add DFS and ZWDFS support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c | 4 ++
+ hostapd/ctrl_iface.c | 95 ++++++++++++++++++++++++++++++++++++
+ src/ap/ap_config.h | 13 +++++
+ src/ap/dfs.c | 35 +++++++------
+ src/ap/dfs.h | 15 ++++++
+ src/ap/hostapd.c | 4 +-
+ src/drivers/driver.h | 7 +++
+ src/drivers/driver_nl80211.c | 29 +++++++++++
+ src/drivers/nl80211_copy.h | 1 +
+ 9 files changed, 186 insertions(+), 17 deletions(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index d9d882c..fd61448 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4801,6 +4801,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ } else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
+ int val = atoi(pos);
+ conf->ibf_enable = !!val;
++ } else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
++ u8 en = strtol(pos, NULL, 10);
++
++ conf->dfs_detect_mode = en;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c881d37..6ea1573 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3522,6 +3522,96 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
+ }
+
+
++static int
++hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
++ char *buf, size_t buflen)
++{
++ u8 dfs_detect_mode;
++
++ if (!value)
++ return -1;
++
++ dfs_detect_mode = strtol(value, NULL, 10);
++ if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
++ wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
++ return -1;
++ }
++ hapd->iconf->dfs_detect_mode = dfs_detect_mode;
++
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++
++static int
++hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ struct hostapd_iface *iface = hapd->iface;
++ char *pos, *param;
++ enum hostapd_hw_mode hw_mode;
++ bool chan_found = false;
++ int i, num_available_chandefs, channel, chan_width, sec = 0;
++ int sec_chan_idx_80p80 = -1;
++ u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
++ struct hostapd_channel_data *chan;
++ enum dfs_channel_type type = DFS_NO_CAC_YET;
++
++ param = os_strchr(cmd, ' ');
++ if (!param)
++ return -1;
++ *param++ = '\0';
++
++ pos = os_strstr(param, "chan=");
++ if (pos)
++ channel = strtol(pos + 5, NULL, 10);
++ else
++ return -1;
++
++ num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
++ for (i = 0; i < num_available_chandefs; i++) {
++ dfs_find_channel(iface, &chan, i, type);
++ if (chan->chan == channel) {
++ chan_found = true;
++ break;
++ }
++ }
++
++ if (!chan_found)
++ return -1;
++
++ if (iface->conf->secondary_channel)
++ sec = 1;
++
++ dfs_adjust_center_freq(iface, chan,
++ sec,
++ sec_chan_idx_80p80,
++ &oper_centr_freq_seg0_idx,
++ &oper_centr_freq_seg1_idx);
++
++ if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
++ chan->freq, chan->chan,
++ iface->conf->ieee80211n,
++ iface->conf->ieee80211ac,
++ iface->conf->ieee80211ax,
++ iface->conf->ieee80211be,
++ sec, hostapd_get_oper_chwidth(iface->conf),
++ oper_centr_freq_seg0_idx,
++ oper_centr_freq_seg1_idx, true)) {
++ wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
++ iface->radar_background.channel = -1;
++ return -1;
++ }
++
++ iface->radar_background.channel = chan->chan;
++ iface->radar_background.freq = chan->freq;
++ iface->radar_background.secondary_channel = sec;
++ iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
++ iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
++
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -4081,6 +4171,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ } else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
+ reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
++ } else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
++ reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
++ reply, reply_size);
++ } else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
++ reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 44a0e7e..3f5afdf 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1159,6 +1159,7 @@ struct hostapd_config {
+ int *edcca_threshold;
+ u8 three_wire_enable;
+ u8 ibf_enable;
++ u8 dfs_detect_mode;
+ };
+
+ enum three_wire_mode {
+@@ -1173,6 +1174,18 @@ enum three_wire_mode {
+ NUM_THREE_WIRE_MODE - 1
+ };
+
++enum dfs_mode {
++ DFS_DETECT_MODE_DISABLE,
++ DFS_DETECT_MODE_AP_ENABLE,
++ DFS_DETECT_MODE_BACKGROUND_ENABLE,
++ DFS_DETECT_MODE_ALL_ENABLE,
++
++ /* keep last */
++ NUM_DFS_DETECT_MODE,
++ DFS_DETECT_MODE_MAX =
++ NUM_DFS_DETECT_MODE - 1
++};
++
+ enum edcca_mode {
+ EDCCA_MODE_FORCE_DISABLE = 0,
+ EDCCA_MODE_AUTO = 1,
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index b5d105d..1c3f678 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -19,13 +19,6 @@
+ #include "dfs.h"
+ #include "crypto/crypto.h"
+
+-
+-enum dfs_channel_type {
+- DFS_ANY_CHANNEL,
+- DFS_AVAILABLE, /* non-radar or radar-available */
+- DFS_NO_CAC_YET, /* radar-not-yet-available */
+-};
+-
+ static struct hostapd_channel_data *
+ dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
+ u8 *oper_centr_freq_seg0_idx,
+@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
+ * - hapd->vht/he_oper_centr_freq_seg0_idx
+ * - hapd->vht/he_oper_centr_freq_seg1_idx
+ */
+-static int dfs_find_channel(struct hostapd_iface *iface,
+- struct hostapd_channel_data **ret_chan,
+- int idx, enum dfs_channel_type type)
++int dfs_find_channel(struct hostapd_iface *iface,
++ struct hostapd_channel_data **ret_chan,
++ int idx, enum dfs_channel_type type)
+ {
+ struct hostapd_hw_modes *mode;
+ struct hostapd_channel_data *chan;
+@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
+ }
+
+
+-static void dfs_adjust_center_freq(struct hostapd_iface *iface,
+- struct hostapd_channel_data *chan,
+- int secondary_channel,
+- int sec_chan_idx_80p80,
+- u8 *oper_centr_freq_seg0_idx,
+- u8 *oper_centr_freq_seg1_idx)
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++ struct hostapd_channel_data *chan,
++ int secondary_channel,
++ int sec_chan_idx_80p80,
++ u8 *oper_centr_freq_seg0_idx,
++ u8 *oper_centr_freq_seg1_idx)
+ {
+ if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
+ return;
+@@ -1317,6 +1310,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ __func__, iface->radar_background.cac_started ? "yes" : "no",
+ hostapd_csa_in_progress(iface) ? "yes" : "no");
+
++ /* Skip channel switch when background dfs detect mode is on */
++ if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
++ iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++ return 0;
++
+ /* Check if CSA in progress */
+ if (hostapd_csa_in_progress(iface))
+ return 0;
+@@ -1365,6 +1363,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
+ __func__, iface->cac_started ? "yes" : "no",
+ hostapd_csa_in_progress(iface) ? "yes" : "no");
+
++ /* Skip channel switch when dfs detect mode is on */
++ if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
++ iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++ return 0;
++
+ /* Check if CSA in progress */
+ if (hostapd_csa_in_progress(iface))
+ return 0;
+diff --git a/src/ap/dfs.h b/src/ap/dfs.h
+index 606c1b3..c2556d2 100644
+--- a/src/ap/dfs.h
++++ b/src/ap/dfs.h
+@@ -9,6 +9,12 @@
+ #ifndef DFS_H
+ #define DFS_H
+
++enum dfs_channel_type {
++ DFS_ANY_CHANNEL,
++ DFS_AVAILABLE, /* non-radar or radar-available */
++ DFS_NO_CAC_YET, /* radar-not-yet-available */
++};
++
+ int hostapd_handle_dfs(struct hostapd_iface *iface);
+
+ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+ int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
+ int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
+ int center_freq);
++int dfs_find_channel(struct hostapd_iface *iface,
++ struct hostapd_channel_data **ret_chan,
++ int idx, enum dfs_channel_type type);
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++ struct hostapd_channel_data *chan,
++ int secondary_channel,
++ int sec_chan_idx_80p80,
++ u8 *oper_centr_freq_seg0_idx,
++ u8 *oper_centr_freq_seg1_idx);
+
+ #endif /* DFS_H */
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index e44b73d..793ce2f 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -1463,7 +1463,9 @@ static int hostapd_setup_bss(struct hostapd_data *hapd, int first)
+ return -1;
+ }
+
+- if (!conf->start_disabled && ieee802_11_set_beacon(hapd) < 0)
++ if (conf->start_disabled)
++ hapd->driver->start_disabled(hapd->drv_priv);
++ else if (ieee802_11_set_beacon(hapd) < 0)
+ return -1;
+
+ if (flush_old_stations && !conf->start_disabled &&
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 71ded61..aa23fbd 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4720,6 +4720,13 @@ struct wpa_driver_ops {
+ *
+ */
+ int (*ibf_dump)(void *priv, u8 *ibf_enable);
++
++ /**
++ * start_disabled - set start_disabled to cfg80211
++ * @priv: Private driver interface data
++ *
++ */
++ int (*start_disabled)(void *priv);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index e974f85..003adc4 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12776,6 +12776,34 @@ fail:
+ return -ENOBUFS;
+ }
+
++static int nl80211_start_disabled(void *priv)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ msg = nl80211_bss_msg(bss, 0, NL80211_CMD_NEW_BEACON);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_flag(msg, NL80211_ATTR_START_DISABLED))
++ goto fail;
++
++ ret = send_and_recv_msgs_connect_handle(drv, msg, bss, 1);
++
++ if (ret)
++ wpa_printf(MSG_ERROR, "Failed to set start_disabled. ret=%d (%s)",
++ ret, strerror(-ret));
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return ret;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+ .desc = "Linux nl80211/cfg80211",
+@@ -12930,4 +12958,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .three_wire_ctrl = nl80211_enable_three_wire,
+ .ibf_ctrl = nl80211_ibf_enable,
+ .ibf_dump = nl80211_ibf_dump,
++ .start_disabled = nl80211_start_disabled,
+ };
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index c4bf3ad..79bc76c 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -3176,6 +3176,7 @@ enum nl80211_attrs {
+ NL80211_ATTR_EHT_CAPABILITY,
+
+ /* add attributes here, update the policy in nl80211.c */
++ NL80211_ATTR_START_DISABLED = 999,
+
+ __NL80211_ATTR_AFTER_LAST,
+ NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/patches.inc b/recipes-wifi/wpa-supplicant/files/patches-2.11/patches.inc
new file mode 100644
index 0000000..388c3d7
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/patches.inc
@@ -0,0 +1,66 @@
+#patch patches (come from openwrt/lede/target/linux/mediatek)
+SRC_URI_append = " \
+ file://001-wolfssl-init-RNG-with-ECC-key.patch \
+ file://010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch \
+ file://011-mesh-use-deterministic-channel-on-channel-switch.patch \
+ file://021-fix-sta-add-after-previous-connection.patch \
+ file://022-hostapd-fix-use-of-uninitialized-stack-variables.patch \
+ file://023-ndisc_snoop-call-dl_list_del-before-freeing-ipv6-add.patch \
+ file://030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch \
+ file://040-mesh-allow-processing-authentication-frames-in-block.patch \
+ file://050-build_fix.patch \
+ file://100-daemonize_fix.patch \
+ file://200-multicall.patch \
+ file://300-noscan.patch \
+ file://301-mesh-noscan.patch \
+ file://310-rescan_immediately.patch \
+ file://320-optional_rfkill.patch \
+ file://330-nl80211_fix_set_freq.patch \
+ file://340-reload_freq_change.patch \
+ file://341-mesh-ctrl-iface-channel-switch.patch \
+ file://350-nl80211_del_beacon_bss.patch \
+ file://360-ctrl_iface_reload.patch \
+ file://370-ap_sta_support.patch \
+ file://380-disable_ctrl_iface_mib.patch \
+ file://381-hostapd_cli_UNKNOWN-COMMAND.patch \
+ file://390-wpa_ie_cap_workaround.patch \
+ file://400-wps_single_auth_enc_type.patch \
+ file://410-limit_debug_messages.patch \
+ file://420-indicate-features.patch \
+ file://430-hostapd_cli_ifdef.patch \
+ file://431-wpa_cli_ifdef.patch \
+ file://432-missing-typedef.patch \
+ file://450-scan_wait.patch;apply=no \
+ file://460-wpa_supplicant-add-new-config-params-to-be-used-with.patch \
+ file://461-driver_nl80211-use-new-parameters-during-ibss-join.patch \
+ file://463-add-mcast_rate-to-11s.patch \
+ file://464-fix-mesh-obss-check.patch \
+ file://465-hostapd-config-support-random-BSS-color.patch \
+ file://470-survey_data_fallback.patch \
+ file://500-lto-jobserver-support.patch \
+ file://590-rrm-wnm-statistics.patch \
+ file://599-wpa_supplicant-fix-warnings.patch \
+ file://600-ubus_support.patch \
+ file://610-hostapd_cli_ujail_permission.patch \
+ file://700-wifi-reload.patch \
+ file://710-vlan_no_bridge.patch \
+ file://711-wds_bridge_force.patch \
+ file://720-iface_max_num_sta.patch \
+ file://730-ft_iface.patch \
+ file://740-snoop_iface.patch \
+ file://750-qos_map_set_without_interworking.patch \
+ file://751-qos_map_ignore_when_unsupported.patch \
+ file://800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch \
+ file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
+ file://992-openssl-include-rsa.patch \
+ file://99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch \
+ file://99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
+ file://99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch \
+ file://99903-hostapd-mtk-Add-mtk_vendor.h.patch \
+ file://99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch \
+ file://99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch \
+ file://99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch \
+ file://99907-hostapd-mtk-Add-hostapd-iBF-control.patch \
+ file://99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch \
+ file://99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch \
+ "
diff --git a/recipes-wifi/wpa-supplicant/wpa-supplicant_2.11.bb b/recipes-wifi/wpa-supplicant/wpa-supplicant_2.11.bb
new file mode 100644
index 0000000..d8ce220
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/wpa-supplicant_2.11.bb
@@ -0,0 +1,157 @@
+SUMMARY = "Client for Wi-Fi Protected Access (WPA)"
+DESCRIPTION = "wpa_supplicant is a WPA Supplicant for Linux, BSD, Mac OS X, and Windows with support for WPA and WPA2 (IEEE 802.11i / RSN). Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association of the wlan driver."
+HOMEPAGE = "http://w1.fi/wpa_supplicant/"
+BUGTRACKER = "http://w1.fi/security/"
+SECTION = "network"
+LICENSE = "BSD-3-Clause"
+LIC_FILES_CHKSUM = "file://hostapd/README;md5=c905478466c90f1cefc0df987c40e172"
+
+DEPENDS = "dbus libnl ubus"
+FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
+FILESEXTRAPATHS_prepend := "${THISDIR}/files/patches-${PV}:"
+
+SRCREV ?= "b704dc72ef824dfdd96674b90179b274d1d38105"
+SRC_URI = "git://w1.fi/hostap.git;protocol=https;branch=main \
+ file://wpa-supplicant.sh \
+ file://wpa_supplicant.conf \
+ file://wpa_supplicant.conf-sane \
+ file://99_wpa_supplicant \
+ file://wpa_supplicant-full.config \
+ file://src \
+ file://001-rdkb-remove-ubus-support.patch;apply=no \
+ "
+require files/patches-${PV}/patches.inc
+
+S = "${WORKDIR}/git"
+
+inherit pkgconfig systemd
+
+PACKAGECONFIG ?= "openssl"
+PACKAGECONFIG[openssl] = ",,openssl"
+
+CVE_PRODUCT = "wpa_supplicant"
+
+EXTRA_OEMAKE = "'LIBDIR=${libdir}' 'INCDIR=${includedir}' 'BINDIR=${sbindir}'"
+
+do_unpack_append() {
+ bb.build.exec_func('do_copy_openwrt_src', d)
+}
+
+do_copy_openwrt_src() {
+ cp -Rfp ${WORKDIR}/src/* ${S}/
+}
+
+do_filogic_patches() {
+ cd ${S}
+ if [ ! -e patch_applied ]; then
+ patch -p1 < ${WORKDIR}/001-rdkb-remove-ubus-support.patch
+ touch patch_applied
+ fi
+}
+
+addtask filogic_patches after do_patch before do_compile
+
+do_configure () {
+ ${MAKE} -C wpa_supplicant clean
+
+ # For rebuild
+ rm -f wpa_supplicant/*.d wpa_supplicant/dbus/*.d
+}
+
+do_configure_append () {
+ # from Openwrt defconfig
+ install -m 0644 ${WORKDIR}/wpa_supplicant-full.config wpa_supplicant/.config
+
+ # RDKB
+ echo "CONFIG_BUILD_WPA_CLIENT_SO=y" >> wpa_supplicant/.config
+
+ # mtk add
+ echo "CONFIG_MBO=y" >> wpa_supplicant/.config
+ echo "CONFIG_WPS_UPNP=y" >> wpa_supplicant/.config
+ echo "CONFIG_DPP=y" >> wpa_supplicant/.config
+ echo "CONFIG_DPP2=y" >> wpa_supplicant/.config
+ echo "CONFIG_DPP3=y" >> wpa_supplicant/.config
+
+ # OpenWRT hostapd Makefile add
+ echo "CONFIG_ACS=y" >> wpa_supplicant/.config
+ echo "CONFIG_IEEE80211AX=y" >> wpa_supplicant/.config
+ echo "CONFIG_TLS=openssl" >> wpa_supplicant/.config
+ echo "CONFIG_SAE=y" >> wpa_supplicant/.config
+ echo "CONFIG_OWE=y" >> wpa_supplicant/.config
+ echo "CONFIG_SUITEB192=y" >> wpa_supplicant/.config
+ echo "CONFIG_WEP=y" >> wpa_supplicant/.config
+ echo "CONFIG_AP=y" >> wpa_supplicant/.config
+ echo "CONFIG_MESH=y" >> wpa_supplicant/.config
+}
+
+do_compile () {
+ oe_runmake -C wpa_supplicant
+ oe_runmake -C wpa_supplicant libwpa_client.a
+}
+
+do_install () {
+ oe_runmake -C wpa_supplicant DESTDIR="${D}" install
+
+ install -d ${D}${docdir}/wpa_supplicant
+ install -m 644 wpa_supplicant/README ${WORKDIR}/wpa_supplicant.conf ${D}${docdir}/wpa_supplicant
+
+ install -d ${D}${sysconfdir}
+ install -m 600 ${WORKDIR}/wpa_supplicant.conf-sane ${D}${sysconfdir}/wpa_supplicant.conf
+
+ install -d ${D}${sysconfdir}/network/if-pre-up.d/
+ install -d ${D}${sysconfdir}/network/if-post-down.d/
+ install -d ${D}${sysconfdir}/network/if-down.d/
+ install -m 755 ${WORKDIR}/wpa-supplicant.sh ${D}${sysconfdir}/network/if-pre-up.d/wpa-supplicant
+ ln -sf ../if-pre-up.d/wpa-supplicant ${D}${sysconfdir}/network/if-post-down.d/wpa-supplicant
+
+ install -d ${D}/${sysconfdir}/dbus-1/system.d
+ install -m 644 ${S}/wpa_supplicant/dbus/dbus-wpa_supplicant.conf ${D}/${sysconfdir}/dbus-1/system.d
+ install -d ${D}/${datadir}/dbus-1/system-services
+ install -m 644 ${S}/wpa_supplicant/dbus/*.service ${D}/${datadir}/dbus-1/system-services
+
+ if ${@bb.utils.contains('DISTRO_FEATURES','systemd','true','false',d)}; then
+ install -d ${D}/${systemd_system_unitdir}
+ install -m 644 ${S}/wpa_supplicant/systemd/*.service ${D}/${systemd_system_unitdir}
+ fi
+
+ install -d ${D}/etc/default/volatiles
+ install -m 0644 ${WORKDIR}/99_wpa_supplicant ${D}/etc/default/volatiles
+
+ install -d ${D}${includedir}
+ install -m 0644 ${S}/src/common/wpa_ctrl.h ${D}${includedir}
+
+ install -d ${D}${libdir}
+ install -m 0644 ${S}/wpa_supplicant/libwpa_client.so ${D}${libdir}
+}
+
+pkg_postinst:${PN} () {
+ # If we're offline, we don't need to do this.
+ if [ "x$D" = "x" ]; then
+ killall -q -HUP dbus-daemon || true
+ fi
+}
+
+PACKAGE_BEFORE_PN += "${PN}-passphrase ${PN}-cli"
+PACKAGES =+ "${PN}-lib"
+PACKAGES += "${PN}-plugins"
+ALLOW_EMPTY:${PN}-plugins = "1"
+
+PACKAGES_DYNAMIC += "^${PN}-plugin-.*$"
+NOAUTOPACKAGEDEBUG = "1"
+
+FILES:${PN}-passphrase = "${sbindir}/wpa_passphrase"
+FILES:${PN}-cli = "${sbindir}/wpa_cli"
+FILES:${PN} += "${datadir}/dbus-1/system-services/* ${systemd_system_unitdir}/*"
+FILES:${PN}-dbg += "${sbindir}/.debug ${libdir}/.debug"
+
+CONFFILES:${PN} += "${sysconfdir}/wpa_supplicant.conf"
+
+RRECOMMENDS:${PN} = "${PN}-passphrase ${PN}-cli ${PN}-plugins"
+
+SYSTEMD_SERVICE:${PN} = "wpa_supplicant.service"
+SYSTEMD_AUTO_ENABLE = "disable"
+
+# move from cmf
+FILES_SOLIBSDEV = ""
+FILES_${PN} += "${libdir}/libwpa_client.so"
+