[rdk-b][common][wifi][Refactor wifi bsp bb to prepare wifi7 support]
[Description]
Refactor wifi bsp bb to prepare wifi7 support
[Release-log]
N/A
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/001-wolfssl-init-RNG-with-ECC-key.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/001-wolfssl-init-RNG-with-ECC-key.patch
new file mode 100644
index 0000000..269dcaa
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/001-wolfssl-init-RNG-with-ECC-key.patch
@@ -0,0 +1,43 @@
+From 21ce83b4ae2b9563175fdb4fc4312096cc399cf8 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Wed, 5 May 2021 00:44:34 +0200
+Subject: [PATCH] wolfssl: add RNG to EC key
+
+Since upstream commit 6467de5a8840 ("Randomize z ordinates in
+scalar mult when timing resistant") WolfSSL requires a RNG for
+the EC key when built hardened which is the default.
+
+Set the RNG for the EC key to fix connections for OWE clients.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ src/crypto/crypto_wolfssl.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/src/crypto/crypto_wolfssl.c
++++ b/src/crypto/crypto_wolfssl.c
+@@ -1340,6 +1340,7 @@ int ecc_projective_add_point(ecc_point *
+
+ struct crypto_ec {
+ ecc_key key;
++ WC_RNG rng;
+ mp_int a;
+ mp_int prime;
+ mp_int order;
+@@ -1394,6 +1395,8 @@ struct crypto_ec * crypto_ec_init(int gr
+ return NULL;
+
+ if (wc_ecc_init(&e->key) != 0 ||
++ wc_InitRng(&e->rng) != 0 ||
++ wc_ecc_set_rng(&e->key, &e->rng) != 0 ||
+ wc_ecc_set_curve(&e->key, 0, curve_id) != 0 ||
+ mp_init(&e->a) != MP_OKAY ||
+ mp_init(&e->prime) != MP_OKAY ||
+@@ -1425,6 +1428,7 @@ void crypto_ec_deinit(struct crypto_ec*
+ mp_clear(&e->order);
+ mp_clear(&e->prime);
+ mp_clear(&e->a);
++ wc_FreeRng(&e->rng);
+ wc_ecc_free(&e->key);
+ os_free(e);
+ }
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
new file mode 100644
index 0000000..6bc48ab
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch
@@ -0,0 +1,106 @@
+From 8de8cd8380af0c43d4fde67a668d79ef73b26b26 Mon Sep 17 00:00:00 2001
+From: Peter Oh <peter.oh@bowerswilkins.com>
+Date: Tue, 30 Jun 2020 14:18:58 +0200
+Subject: [PATCH 10/19] mesh: Allow DFS channels to be selected if dfs is
+ enabled
+
+Note: DFS is assumed to be usable if a country code has been set
+
+Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
+Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
+---
+ wpa_supplicant/wpa_supplicant.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -2436,7 +2436,7 @@ static int drv_supports_vht(struct wpa_s
+ }
+
+
+-static bool ibss_mesh_is_80mhz_avail(int channel, struct hostapd_hw_modes *mode)
++static bool ibss_mesh_is_80mhz_avail(int channel, struct hostapd_hw_modes *mode, bool dfs_enabled)
+ {
+ int i;
+
+@@ -2445,7 +2445,10 @@ static bool ibss_mesh_is_80mhz_avail(int
+
+ chan = hw_get_channel_chan(mode, i, NULL);
+ if (!chan ||
+- chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
++ chan->flag & HOSTAPD_CHAN_DISABLED)
++ return false;
++
++ if (!dfs_enabled && chan->flag & (HOSTAPD_CHAN_RADAR | HOSTAPD_CHAN_NO_IR))
+ return false;
+ }
+
+@@ -2474,6 +2477,8 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ int chwidth, seg0, seg1;
+ u32 vht_caps = 0;
+ bool is_24ghz, is_6ghz;
++ bool dfs_enabled = wpa_s->conf->country[0] &&
++ (wpa_s->drv_flags & WPA_DRIVER_FLAGS_RADAR);
+
+ freq->freq = ssid->frequency;
+
+@@ -2570,8 +2575,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ return;
+
+ /* Check primary channel flags */
+- if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
++ if (pri_chan->flag & HOSTAPD_CHAN_DISABLED)
+ return;
++ if (pri_chan->flag & (HOSTAPD_CHAN_RADAR | HOSTAPD_CHAN_NO_IR))
++ if (!dfs_enabled)
++ return;
+
+ freq->channel = pri_chan->chan;
+
+@@ -2604,8 +2612,11 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ return;
+
+ /* Check secondary channel flags */
+- if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
++ if (sec_chan->flag & HOSTAPD_CHAN_DISABLED)
+ return;
++ if (sec_chan->flag & (HOSTAPD_CHAN_RADAR | HOSTAPD_CHAN_NO_IR))
++ if (!dfs_enabled)
++ return;
+
+ if (ht40 == -1) {
+ if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
+@@ -2694,7 +2705,7 @@ skip_to_6ghz:
+ return;
+
+ /* Back to HT configuration if channel not usable */
+- if (!ibss_mesh_is_80mhz_avail(channel, mode))
++ if (!ibss_mesh_is_80mhz_avail(channel, mode, dfs_enabled))
+ return;
+
+ chwidth = CONF_OPER_CHWIDTH_80MHZ;
+@@ -2708,7 +2719,7 @@ skip_to_6ghz:
+ * above; check the remaining four 20 MHz channels for the total
+ * of 160 MHz bandwidth.
+ */
+- if (!ibss_mesh_is_80mhz_avail(channel + 16, mode))
++ if (!ibss_mesh_is_80mhz_avail(channel + 16, mode, dfs_enabled))
+ return;
+
+ for (j = 0; j < ARRAY_SIZE(bw160); j++) {
+@@ -2738,10 +2749,12 @@ skip_to_6ghz:
+ if (!chan)
+ continue;
+
+- if (chan->flag & (HOSTAPD_CHAN_DISABLED |
+- HOSTAPD_CHAN_NO_IR |
+- HOSTAPD_CHAN_RADAR))
++ if (chan->flag & HOSTAPD_CHAN_DISABLED)
+ continue;
++ if (chan->flag & (HOSTAPD_CHAN_RADAR |
++ HOSTAPD_CHAN_NO_IR))
++ if (!dfs_enabled)
++ continue;
+
+ /* Found a suitable second segment for 80+80 */
+ chwidth = CONF_OPER_CHWIDTH_80P80MHZ;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/011-mesh-use-deterministic-channel-on-channel-switch.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/011-mesh-use-deterministic-channel-on-channel-switch.patch
new file mode 100644
index 0000000..32a4479
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/011-mesh-use-deterministic-channel-on-channel-switch.patch
@@ -0,0 +1,81 @@
+From fc8ea40f6130ac18d9c66797de2cf1d5af55d496 Mon Sep 17 00:00:00 2001
+From: Markus Theil <markus.theil@tu-ilmenau.de>
+Date: Tue, 30 Jun 2020 14:19:07 +0200
+Subject: [PATCH 19/19] mesh: use deterministic channel on channel switch
+
+This patch uses a deterministic channel on DFS channel switch
+in mesh networks. Otherwise, when switching to a usable but not
+available channel, no CSA can be sent and a random channel is choosen
+without notification of other nodes. It is then quite likely, that
+the mesh network gets disconnected.
+
+Fix this by using a deterministic number, based on the sha256 hash
+of the mesh ID, in order to use at least a different number in each
+mesh network.
+
+Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
+---
+ src/ap/dfs.c | 20 +++++++++++++++++++-
+ src/drivers/driver_nl80211.c | 4 ++++
+ 2 files changed, 23 insertions(+), 1 deletion(-)
+
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -17,6 +17,7 @@
+ #include "ap_drv_ops.h"
+ #include "drivers/driver.h"
+ #include "dfs.h"
++#include "crypto/crypto.h"
+
+
+ enum dfs_channel_type {
+@@ -515,9 +516,14 @@ dfs_get_valid_channel(struct hostapd_ifa
+ int num_available_chandefs;
+ int chan_idx, chan_idx2;
+ int sec_chan_idx_80p80 = -1;
++ bool is_mesh = false;
+ int i;
+ u32 _rand;
+
++#ifdef CONFIG_MESH
++ is_mesh = iface->mconf;
++#endif
++
+ wpa_printf(MSG_DEBUG, "DFS: Selecting random channel");
+ *secondary_channel = 0;
+ *oper_centr_freq_seg0_idx = 0;
+@@ -537,8 +543,20 @@ dfs_get_valid_channel(struct hostapd_ifa
+ if (num_available_chandefs == 0)
+ return NULL;
+
+- if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
++ /* try to use deterministic channel in mesh, so that both sides
++ * have a chance to switch to the same channel */
++ if (is_mesh) {
++#ifdef CONFIG_MESH
++ u64 hash[4];
++ const u8 *meshid[1] = { &iface->mconf->meshid[0] };
++ const size_t meshid_len = iface->mconf->meshid_len;
++
++ sha256_vector(1, meshid, &meshid_len, (u8 *)&hash[0]);
++ _rand = hash[0] + hash[1] + hash[2] + hash[3];
++#endif
++ } else if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
+ return NULL;
++
+ chan_idx = _rand % num_available_chandefs;
+ dfs_find_channel(iface, &chan, chan_idx, type);
+ if (!chan) {
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -9948,6 +9948,10 @@ static int nl80211_switch_channel(void *
+ if (ret)
+ goto error;
+
++ if (drv->nlmode == NL80211_IFTYPE_MESH_POINT) {
++ nla_put_flag(msg, NL80211_ATTR_HANDLE_DFS);
++ }
++
+ /* beacon_csa params */
+ beacon_csa = nla_nest_start(msg, NL80211_ATTR_CSA_IES);
+ if (!beacon_csa)
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/021-fix-sta-add-after-previous-connection.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/021-fix-sta-add-after-previous-connection.patch
new file mode 100644
index 0000000..80b23bd
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/021-fix-sta-add-after-previous-connection.patch
@@ -0,0 +1,26 @@
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -4963,6 +4963,13 @@ static int add_associated_sta(struct hos
+ * drivers to accept the STA parameter configuration. Since this is
+ * after a new FT-over-DS exchange, a new TK has been derived, so key
+ * reinstallation is not a concern for this case.
++ *
++ * If the STA was associated and authorized earlier, but came for a new
++ * connection (!added_unassoc + !reassoc), remove the existing STA entry
++ * so that it can be re-added. This case is rarely seen when the AP could
++ * not receive the deauth/disassoc frame from the STA. And the STA comes
++ * back with new connection within a short period or before the inactive
++ * STA entry is removed from the list.
+ */
+ wpa_printf(MSG_DEBUG, "Add associated STA " MACSTR
+ " (added_unassoc=%d auth_alg=%u ft_over_ds=%u reassoc=%d authorized=%d ft_tk=%d fils_tk=%d)",
+@@ -4976,7 +4983,8 @@ static int add_associated_sta(struct hos
+ (!(sta->flags & WLAN_STA_AUTHORIZED) ||
+ (reassoc && sta->ft_over_ds && sta->auth_alg == WLAN_AUTH_FT) ||
+ (!wpa_auth_sta_ft_tk_already_set(sta->wpa_sm) &&
+- !wpa_auth_sta_fils_tk_already_set(sta->wpa_sm)))) {
++ !wpa_auth_sta_fils_tk_already_set(sta->wpa_sm)) ||
++ (!reassoc && (sta->flags & WLAN_STA_AUTHORIZED)))) {
+ hostapd_drv_sta_remove(hapd, sta->addr);
+ wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED);
+ set = 0;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/022-hostapd-fix-use-of-uninitialized-stack-variables.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/022-hostapd-fix-use-of-uninitialized-stack-variables.patch
new file mode 100644
index 0000000..25801da
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/022-hostapd-fix-use-of-uninitialized-stack-variables.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 8 Jul 2021 16:33:03 +0200
+Subject: [PATCH] hostapd: fix use of uninitialized stack variables
+
+When a CSA is performed on an 80 MHz channel, hostapd_change_config_freq
+unconditionally calls hostapd_set_oper_centr_freq_seg0/1_idx with seg0/1
+filled by ieee80211_freq_to_chan.
+However, if ieee80211_freq_to_chan fails (because the freq is 0 or invalid),
+seg0/1 remains uninitialized and filled with stack garbage, causing errors
+such as "hostapd: 80 MHz: center segment 1 configured"
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -3453,7 +3453,7 @@ static int hostapd_change_config_freq(st
+ struct hostapd_freq_params *old_params)
+ {
+ int channel;
+- u8 seg0, seg1;
++ u8 seg0 = 0, seg1 = 0;
+ struct hostapd_hw_modes *mode;
+
+ if (!params->channel) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/023-ndisc_snoop-call-dl_list_del-before-freeing-ipv6-add.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/023-ndisc_snoop-call-dl_list_del-before-freeing-ipv6-add.patch
new file mode 100644
index 0000000..9ff9b23
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/023-ndisc_snoop-call-dl_list_del-before-freeing-ipv6-add.patch
@@ -0,0 +1,19 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 28 Jul 2021 05:43:29 +0200
+Subject: [PATCH] ndisc_snoop: call dl_list_del before freeing ipv6 addresses
+
+Fixes a segmentation fault on sta disconnect
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/ap/ndisc_snoop.c
++++ b/src/ap/ndisc_snoop.c
+@@ -61,6 +61,7 @@ void sta_ip6addr_del(struct hostapd_data
+ dl_list_for_each_safe(ip6addr, prev, &sta->ip6addr, struct ip6addr,
+ list) {
+ hostapd_drv_br_delete_ip_neigh(hapd, 6, (u8 *) &ip6addr->addr);
++ dl_list_del(&ip6addr->list);
+ os_free(ip6addr);
+ }
+ }
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
new file mode 100644
index 0000000..988fbbc
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch
@@ -0,0 +1,275 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 28 Jul 2021 05:49:46 +0200
+Subject: [PATCH] driver_nl80211: rewrite neigh code to not depend on
+ libnl3-route
+
+Removes an unnecessary dependency and also makes the code smaller
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -16,9 +16,6 @@
+ #include <net/if.h>
+ #include <netlink/genl/genl.h>
+ #include <netlink/genl/ctrl.h>
+-#ifdef CONFIG_LIBNL3_ROUTE
+-#include <netlink/route/neighbour.h>
+-#endif /* CONFIG_LIBNL3_ROUTE */
+ #include <linux/rtnetlink.h>
+ #include <netpacket/packet.h>
+ #include <linux/errqueue.h>
+@@ -5344,26 +5341,29 @@ fail:
+
+ static void rtnl_neigh_delete_fdb_entry(struct i802_bss *bss, const u8 *addr)
+ {
+-#ifdef CONFIG_LIBNL3_ROUTE
+ struct wpa_driver_nl80211_data *drv = bss->drv;
+- struct rtnl_neigh *rn;
+- struct nl_addr *nl_addr;
++ struct ndmsg nhdr = {
++ .ndm_state = NUD_PERMANENT,
++ .ndm_ifindex = bss->ifindex,
++ .ndm_family = AF_BRIDGE,
++ };
++ struct nl_msg *msg;
+ int err;
+
+- rn = rtnl_neigh_alloc();
+- if (!rn)
++ msg = nlmsg_alloc_simple(RTM_DELNEIGH, NLM_F_CREATE);
++ if (!msg)
+ return;
+
+- rtnl_neigh_set_family(rn, AF_BRIDGE);
+- rtnl_neigh_set_ifindex(rn, bss->ifindex);
+- nl_addr = nl_addr_build(AF_BRIDGE, (void *) addr, ETH_ALEN);
+- if (!nl_addr) {
+- rtnl_neigh_put(rn);
+- return;
+- }
+- rtnl_neigh_set_lladdr(rn, nl_addr);
++ if (nlmsg_append(msg, &nhdr, sizeof(nhdr), NLMSG_ALIGNTO) < 0)
++ goto errout;
++
++ if (nla_put(msg, NDA_LLADDR, ETH_ALEN, (void *)addr))
++ goto errout;
++
++ if (nl_send_auto_complete(drv->rtnl_sk, msg) < 0)
++ goto errout;
+
+- err = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
++ err = nl_wait_for_ack(drv->rtnl_sk);
+ if (err < 0) {
+ wpa_printf(MSG_DEBUG, "nl80211: bridge FDB entry delete for "
+ MACSTR " ifindex=%d failed: %s", MAC2STR(addr),
+@@ -5373,9 +5373,8 @@ static void rtnl_neigh_delete_fdb_entry(
+ MACSTR, MAC2STR(addr));
+ }
+
+- nl_addr_put(nl_addr);
+- rtnl_neigh_put(rn);
+-#endif /* CONFIG_LIBNL3_ROUTE */
++errout:
++ nlmsg_free(msg);
+ }
+
+
+@@ -7763,7 +7762,6 @@ static void *i802_init(struct hostapd_da
+ (params->num_bridge == 0 || !params->bridge[0]))
+ add_ifidx(drv, br_ifindex, drv->ifindex);
+
+-#ifdef CONFIG_LIBNL3_ROUTE
+ if (bss->added_if_into_bridge || bss->already_in_bridge) {
+ int err;
+
+@@ -7780,7 +7778,6 @@ static void *i802_init(struct hostapd_da
+ goto failed;
+ }
+ }
+-#endif /* CONFIG_LIBNL3_ROUTE */
+
+ if (drv->capa.flags2 & WPA_DRIVER_FLAGS2_CONTROL_PORT_RX) {
+ wpa_printf(MSG_DEBUG,
+@@ -10813,13 +10810,14 @@ static int wpa_driver_br_add_ip_neigh(vo
+ const u8 *ipaddr, int prefixlen,
+ const u8 *addr)
+ {
+-#ifdef CONFIG_LIBNL3_ROUTE
+ struct i802_bss *bss = priv;
+ struct wpa_driver_nl80211_data *drv = bss->drv;
+- struct rtnl_neigh *rn;
+- struct nl_addr *nl_ipaddr = NULL;
+- struct nl_addr *nl_lladdr = NULL;
+- int family, addrsize;
++ struct ndmsg nhdr = {
++ .ndm_state = NUD_PERMANENT,
++ .ndm_ifindex = bss->br_ifindex,
++ };
++ struct nl_msg *msg;
++ int addrsize;
+ int res;
+
+ if (!ipaddr || prefixlen == 0 || !addr)
+@@ -10838,85 +10836,66 @@ static int wpa_driver_br_add_ip_neigh(vo
+ }
+
+ if (version == 4) {
+- family = AF_INET;
++ nhdr.ndm_family = AF_INET;
+ addrsize = 4;
+ } else if (version == 6) {
+- family = AF_INET6;
++ nhdr.ndm_family = AF_INET6;
+ addrsize = 16;
+ } else {
+ return -EINVAL;
+ }
+
+- rn = rtnl_neigh_alloc();
+- if (rn == NULL)
++ msg = nlmsg_alloc_simple(RTM_NEWNEIGH, NLM_F_CREATE);
++ if (!msg)
+ return -ENOMEM;
+
+- /* set the destination ip address for neigh */
+- nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
+- if (nl_ipaddr == NULL) {
+- wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
+- res = -ENOMEM;
++ res = -ENOMEM;
++ if (nlmsg_append(msg, &nhdr, sizeof(nhdr), NLMSG_ALIGNTO) < 0)
+ goto errout;
+- }
+- nl_addr_set_prefixlen(nl_ipaddr, prefixlen);
+- res = rtnl_neigh_set_dst(rn, nl_ipaddr);
+- if (res) {
+- wpa_printf(MSG_DEBUG,
+- "nl80211: neigh set destination addr failed");
++
++ if (nla_put(msg, NDA_DST, addrsize, (void *)ipaddr))
+ goto errout;
+- }
+
+- /* set the corresponding lladdr for neigh */
+- nl_lladdr = nl_addr_build(AF_BRIDGE, (u8 *) addr, ETH_ALEN);
+- if (nl_lladdr == NULL) {
+- wpa_printf(MSG_DEBUG, "nl80211: neigh set lladdr failed");
+- res = -ENOMEM;
++ if (nla_put(msg, NDA_LLADDR, ETH_ALEN, (void *)addr))
+ goto errout;
+- }
+- rtnl_neigh_set_lladdr(rn, nl_lladdr);
+
+- rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
+- rtnl_neigh_set_state(rn, NUD_PERMANENT);
++ res = nl_send_auto_complete(drv->rtnl_sk, msg);
++ if (res < 0)
++ goto errout;
+
+- res = rtnl_neigh_add(drv->rtnl_sk, rn, NLM_F_CREATE);
++ res = nl_wait_for_ack(drv->rtnl_sk);
+ if (res) {
+ wpa_printf(MSG_DEBUG,
+ "nl80211: Adding bridge ip neigh failed: %s",
+ nl_geterror(res));
+ }
+ errout:
+- if (nl_lladdr)
+- nl_addr_put(nl_lladdr);
+- if (nl_ipaddr)
+- nl_addr_put(nl_ipaddr);
+- if (rn)
+- rtnl_neigh_put(rn);
++ nlmsg_free(msg);
+ return res;
+-#else /* CONFIG_LIBNL3_ROUTE */
+- return -1;
+-#endif /* CONFIG_LIBNL3_ROUTE */
+ }
+
+
+ static int wpa_driver_br_delete_ip_neigh(void *priv, u8 version,
+ const u8 *ipaddr)
+ {
+-#ifdef CONFIG_LIBNL3_ROUTE
+ struct i802_bss *bss = priv;
+ struct wpa_driver_nl80211_data *drv = bss->drv;
+- struct rtnl_neigh *rn;
+- struct nl_addr *nl_ipaddr;
+- int family, addrsize;
++ struct ndmsg nhdr = {
++ .ndm_state = NUD_PERMANENT,
++ .ndm_ifindex = bss->br_ifindex,
++ };
++ struct nl_msg *msg;
++ int addrsize;
+ int res;
+
+ if (!ipaddr)
+ return -EINVAL;
+
+ if (version == 4) {
+- family = AF_INET;
++ nhdr.ndm_family = AF_INET;
+ addrsize = 4;
+ } else if (version == 6) {
+- family = AF_INET6;
++ nhdr.ndm_family = AF_INET6;
+ addrsize = 16;
+ } else {
+ return -EINVAL;
+@@ -10934,41 +10913,30 @@ static int wpa_driver_br_delete_ip_neigh
+ return -1;
+ }
+
+- rn = rtnl_neigh_alloc();
+- if (rn == NULL)
++ msg = nlmsg_alloc_simple(RTM_DELNEIGH, NLM_F_CREATE);
++ if (!msg)
+ return -ENOMEM;
+
+- /* set the destination ip address for neigh */
+- nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
+- if (nl_ipaddr == NULL) {
+- wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
+- res = -ENOMEM;
++ res = -ENOMEM;
++ if (nlmsg_append(msg, &nhdr, sizeof(nhdr), NLMSG_ALIGNTO) < 0)
+ goto errout;
+- }
+- res = rtnl_neigh_set_dst(rn, nl_ipaddr);
+- if (res) {
+- wpa_printf(MSG_DEBUG,
+- "nl80211: neigh set destination addr failed");
++
++ if (nla_put(msg, NDA_DST, addrsize, (void *)ipaddr))
+ goto errout;
+- }
+
+- rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
++ res = nl_send_auto_complete(drv->rtnl_sk, msg);
++ if (res < 0)
++ goto errout;
+
+- res = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
++ res = nl_wait_for_ack(drv->rtnl_sk);
+ if (res) {
+ wpa_printf(MSG_DEBUG,
+ "nl80211: Deleting bridge ip neigh failed: %s",
+ nl_geterror(res));
+ }
+ errout:
+- if (nl_ipaddr)
+- nl_addr_put(nl_ipaddr);
+- if (rn)
+- rtnl_neigh_put(rn);
++ nlmsg_free(msg);
+ return res;
+-#else /* CONFIG_LIBNL3_ROUTE */
+- return -1;
+-#endif /* CONFIG_LIBNL3_ROUTE */
+ }
+
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/040-mesh-allow-processing-authentication-frames-in-block.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/040-mesh-allow-processing-authentication-frames-in-block.patch
new file mode 100644
index 0000000..6b34cd4
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/040-mesh-allow-processing-authentication-frames-in-block.patch
@@ -0,0 +1,34 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 18 Feb 2019 12:57:11 +0100
+Subject: [PATCH] mesh: allow processing authentication frames in blocked state
+
+If authentication fails repeatedly e.g. because of a weak signal, the link
+can end up in blocked state. If one of the nodes tries to establish a link
+again before it is unblocked on the other side, it will block the link to
+that other side. The same happens on the other side when it unblocks the
+link. In that scenario, the link never recovers on its own.
+
+To fix this, allow restarting authentication even if the link is in blocked
+state, but don't initiate the attempt until the blocked period is over.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -3781,15 +3781,6 @@ static void handle_auth(struct hostapd_d
+ seq_ctrl);
+ return;
+ }
+-#ifdef CONFIG_MESH
+- if ((hapd->conf->mesh & MESH_ENABLED) &&
+- sta->plink_state == PLINK_BLOCKED) {
+- wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
+- " is blocked - drop Authentication frame",
+- MAC2STR(mgmt->sa));
+- return;
+- }
+-#endif /* CONFIG_MESH */
+ #ifdef CONFIG_PASN
+ if (auth_alg == WLAN_AUTH_PASN &&
+ (sta->flags & WLAN_STA_ASSOC)) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/050-build_fix.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/050-build_fix.patch
new file mode 100644
index 0000000..c9268f5
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/050-build_fix.patch
@@ -0,0 +1,20 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -324,6 +324,7 @@ ifdef CONFIG_FILS
+ CFLAGS += -DCONFIG_FILS
+ OBJS += ../src/ap/fils_hlp.o
+ NEED_SHA384=y
++NEED_HMAC_SHA384_KDF=y
+ NEED_AES_SIV=y
+ ifdef CONFIG_FILS_SK_PFS
+ CFLAGS += -DCONFIG_FILS_SK_PFS
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -320,6 +320,7 @@ endif
+ ifdef CONFIG_FILS
+ CFLAGS += -DCONFIG_FILS
+ NEED_SHA384=y
++NEED_HMAC_SHA384_KDF=y
+ NEED_AES_SIV=y
+ ifdef CONFIG_FILS_SK_PFS
+ CFLAGS += -DCONFIG_FILS_SK_PFS
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/100-daemonize_fix.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/100-daemonize_fix.patch
new file mode 100644
index 0000000..687bd40
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/100-daemonize_fix.patch
@@ -0,0 +1,97 @@
+--- a/src/utils/os_unix.c
++++ b/src/utils/os_unix.c
+@@ -10,6 +10,7 @@
+
+ #include <time.h>
+ #include <sys/wait.h>
++#include <fcntl.h>
+
+ #ifdef ANDROID
+ #include <sys/capability.h>
+@@ -188,59 +189,46 @@ int os_gmtime(os_time_t t, struct os_tm
+ return 0;
+ }
+
+-
+-#ifdef __APPLE__
+-#include <fcntl.h>
+-static int os_daemon(int nochdir, int noclose)
++int os_daemonize(const char *pid_file)
+ {
+- int devnull;
++ int pid = 0, i, devnull;
+
+- if (chdir("/") < 0)
+- return -1;
++#if defined(__uClinux__) || defined(__sun__)
++ return -1;
++#else /* defined(__uClinux__) || defined(__sun__) */
+
+- devnull = open("/dev/null", O_RDWR);
+- if (devnull < 0)
++#ifndef __APPLE__
++ pid = fork();
++ if (pid < 0)
+ return -1;
++#endif
+
+- if (dup2(devnull, STDIN_FILENO) < 0) {
+- close(devnull);
+- return -1;
++ if (pid > 0) {
++ if (pid_file) {
++ FILE *f = fopen(pid_file, "w");
++ if (f) {
++ fprintf(f, "%u\n", pid);
++ fclose(f);
++ }
++ }
++ _exit(0);
+ }
+
+- if (dup2(devnull, STDOUT_FILENO) < 0) {
+- close(devnull);
++ if (setsid() < 0)
+ return -1;
+- }
+
+- if (dup2(devnull, STDERR_FILENO) < 0) {
+- close(devnull);
++ if (chdir("/") < 0)
+ return -1;
+- }
+-
+- return 0;
+-}
+-#else /* __APPLE__ */
+-#define os_daemon daemon
+-#endif /* __APPLE__ */
+
+-
+-int os_daemonize(const char *pid_file)
+-{
+-#if defined(__uClinux__) || defined(__sun__)
+- return -1;
+-#else /* defined(__uClinux__) || defined(__sun__) */
+- if (os_daemon(0, 0)) {
+- perror("daemon");
++ devnull = open("/dev/null", O_RDWR);
++ if (devnull < 0)
+ return -1;
+- }
+
+- if (pid_file) {
+- FILE *f = fopen(pid_file, "w");
+- if (f) {
+- fprintf(f, "%u\n", getpid());
+- fclose(f);
+- }
+- }
++ for (i = 0; i <= STDERR_FILENO; i++)
++ dup2(devnull, i);
++
++ if (devnull > 2)
++ close(devnull);
+
+ return -0;
+ #endif /* defined(__uClinux__) || defined(__sun__) */
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/200-multicall.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/200-multicall.patch
new file mode 100644
index 0000000..576c671
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/200-multicall.patch
@@ -0,0 +1,355 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -1,6 +1,7 @@
+ ALL=hostapd hostapd_cli
+ CONFIG_FILE = .config
+
++-include $(if $(MULTICALL), ../wpa_supplicant/.config)
+ include ../src/build.rules
+
+ ifdef LIBS
+@@ -199,7 +200,8 @@ endif
+
+ ifdef CONFIG_NO_VLAN
+ CFLAGS += -DCONFIG_NO_VLAN
+-else
++endif
++ifneq ($(findstring CONFIG_NO_VLAN,$(CFLAGS)), CONFIG_NO_VLAN)
+ OBJS += ../src/ap/vlan_init.o
+ OBJS += ../src/ap/vlan_ifconfig.o
+ OBJS += ../src/ap/vlan.o
+@@ -357,10 +359,14 @@ CFLAGS += -DCONFIG_MBO
+ OBJS += ../src/ap/mbo_ap.o
+ endif
+
++ifndef MULTICALL
++CFLAGS += -DNO_SUPPLICANT
++endif
++
+ include ../src/drivers/drivers.mak
+-OBJS += $(DRV_AP_OBJS)
+-CFLAGS += $(DRV_AP_CFLAGS)
+-LDFLAGS += $(DRV_AP_LDFLAGS)
++OBJS += $(sort $(DRV_AP_OBJS) $(if $(MULTICALL),$(DRV_WPA_OBJS)))
++CFLAGS += $(DRV_AP_CFLAGS) $(if $(MULTICALL),$(DRV_WPA_CFLAGS))
++LDFLAGS += $(DRV_AP_LDFLAGS) $(if $(MULTICALL),$(DRV_WPA_LDFLAGS))
+ LIBS += $(DRV_AP_LIBS)
+
+ ifdef CONFIG_L2_PACKET
+@@ -1291,6 +1297,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
+ _OBJS_VAR := OBJS
+ include ../src/objs.mk
+
++hostapd_multi.a: $(BCHECK) $(OBJS)
++ $(Q)$(CC) -c -o hostapd_multi.o -Dmain=hostapd_main $(CFLAGS) main.c
++ @$(E) " CC " $<
++ @rm -f $@
++ @$(AR) cr $@ hostapd_multi.o $(OBJS)
++
+ hostapd: $(OBJS)
+ $(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
+ @$(E) " LD " $@
+@@ -1365,6 +1377,12 @@ include ../src/objs.mk
+ _OBJS_VAR := SOBJS
+ include ../src/objs.mk
+
++dump_cflags:
++ @printf "%s " "$(CFLAGS)"
++
++dump_ldflags:
++ @printf "%s " "$(LDFLAGS) $(LIBS) $(EXTRALIBS)"
++
+ nt_password_hash: $(NOBJS)
+ $(Q)$(CC) $(LDFLAGS) -o nt_password_hash $(NOBJS) $(LIBS_n)
+ @$(E) " LD " $@
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -10,6 +10,7 @@ ALL += dbus/fi.w1.wpa_supplicant1.servic
+ EXTRA_TARGETS=dynamic_eap_methods
+
+ CONFIG_FILE=.config
++-include $(if $(MULTICALL),../hostapd/.config)
+ include ../src/build.rules
+
+ ifdef CONFIG_BUILD_WPA_CLIENT_SO
+@@ -371,7 +372,9 @@ endif
+ ifdef CONFIG_IBSS_RSN
+ NEED_RSN_AUTHENTICATOR=y
+ CFLAGS += -DCONFIG_IBSS_RSN
++ifndef MULTICALL
+ CFLAGS += -DCONFIG_NO_VLAN
++endif
+ OBJS += ibss_rsn.o
+ endif
+
+@@ -912,6 +915,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
+ CFLAGS += -DCONFIG_DYNAMIC_EAP_METHODS
+ LIBS += -ldl -rdynamic
+ endif
++else
++ ifdef MULTICALL
++ OBJS += ../src/eap_common/eap_common.o
++ endif
+ endif
+
+ ifdef CONFIG_AP
+@@ -919,9 +926,11 @@ NEED_EAP_COMMON=y
+ NEED_RSN_AUTHENTICATOR=y
+ CFLAGS += -DCONFIG_AP
+ OBJS += ap.o
++ifndef MULTICALL
+ CFLAGS += -DCONFIG_NO_RADIUS
+ CFLAGS += -DCONFIG_NO_ACCOUNTING
+ CFLAGS += -DCONFIG_NO_VLAN
++endif
+ OBJS += ../src/ap/hostapd.o
+ OBJS += ../src/ap/wpa_auth_glue.o
+ OBJS += ../src/ap/utils.o
+@@ -1008,6 +1017,12 @@ endif
+ ifdef CONFIG_HS20
+ OBJS += ../src/ap/hs20.o
+ endif
++else
++ ifdef MULTICALL
++ OBJS += ../src/eap_server/eap_server.o
++ OBJS += ../src/eap_server/eap_server_identity.o
++ OBJS += ../src/eap_server/eap_server_methods.o
++ endif
+ endif
+
+ ifdef CONFIG_MBO
+@@ -1016,7 +1031,9 @@ CFLAGS += -DCONFIG_MBO
+ endif
+
+ ifdef NEED_RSN_AUTHENTICATOR
++ifndef MULTICALL
+ CFLAGS += -DCONFIG_NO_RADIUS
++endif
+ NEED_AES_WRAP=y
+ OBJS += ../src/ap/wpa_auth.o
+ OBJS += ../src/ap/wpa_auth_ie.o
+@@ -1920,6 +1937,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
+
+ _OBJS_VAR := OBJS
+ include ../src/objs.mk
++wpa_supplicant_multi.a: .config $(BCHECK) $(OBJS) $(EXTRA_progs)
++ $(Q)$(CC) -c -o wpa_supplicant_multi.o -Dmain=wpa_supplicant_main $(CFLAGS) main.c
++ @$(E) " CC " $<
++ @rm -f $@
++ @$(AR) cr $@ wpa_supplicant_multi.o $(OBJS)
++
+ wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
+ $(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
+ @$(E) " LD " $@
+@@ -2052,6 +2075,12 @@ eap_gpsk.so: $(SRC_EAP_GPSK)
+ $(Q)sed -e 's|\@BINDIR\@|$(BINDIR)|g' $< >$@
+ @$(E) " sed" $<
+
++dump_cflags:
++ @printf "%s " "$(CFLAGS)"
++
++dump_ldflags:
++ @printf "%s " "$(LDFLAGS) $(LIBS) $(EXTRALIBS)"
++
+ wpa_supplicant.exe: wpa_supplicant
+ mv -f $< $@
+ wpa_cli.exe: wpa_cli
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -6171,8 +6171,8 @@ union wpa_event_data {
+ * Driver wrapper code should call this function whenever an event is received
+ * from the driver.
+ */
+-void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
+- union wpa_event_data *data);
++extern void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ /**
+ * wpa_supplicant_event_global - Report a driver event for wpa_supplicant
+@@ -6184,7 +6184,7 @@ void wpa_supplicant_event(void *ctx, enu
+ * Same as wpa_supplicant_event(), but we search for the interface in
+ * wpa_global.
+ */
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++extern void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data);
+
+ /*
+--- a/src/ap/drv_callbacks.c
++++ b/src/ap/drv_callbacks.c
+@@ -1872,8 +1872,8 @@ err:
+ #endif /* CONFIG_OWE */
+
+
+-void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
+- union wpa_event_data *data)
++void hostapd_wpa_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data)
+ {
+ struct hostapd_data *hapd = ctx;
+ #ifndef CONFIG_NO_STDOUT_DEBUG
+@@ -2145,7 +2145,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+
+
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++void hostapd_wpa_event_global(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data)
+ {
+ struct hapd_interfaces *interfaces = ctx;
+--- a/wpa_supplicant/wpa_priv.c
++++ b/wpa_supplicant/wpa_priv.c
+@@ -1038,8 +1038,8 @@ static void wpa_priv_send_ft_response(st
+ }
+
+
+-void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
+- union wpa_event_data *data)
++static void supplicant_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data)
+ {
+ struct wpa_priv_interface *iface = ctx;
+
+@@ -1102,7 +1102,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+
+
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++void supplicant_event_global(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data)
+ {
+ struct wpa_priv_global *global = ctx;
+@@ -1216,6 +1216,8 @@ int main(int argc, char *argv[])
+ if (os_program_init())
+ return -1;
+
++ wpa_supplicant_event = supplicant_event;
++ wpa_supplicant_event_global = supplicant_event_global;
+ wpa_priv_fd_workaround();
+
+ os_memset(&global, 0, sizeof(global));
+--- a/wpa_supplicant/events.c
++++ b/wpa_supplicant/events.c
+@@ -4953,8 +4953,8 @@ static void wpas_event_unprot_beacon(str
+ }
+
+
+-void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
+- union wpa_event_data *data)
++void supplicant_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data)
+ {
+ struct wpa_supplicant *wpa_s = ctx;
+ int resched;
+@@ -5813,7 +5813,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+
+
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++void supplicant_event_global(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data)
+ {
+ struct wpa_supplicant *wpa_s;
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -7087,7 +7087,6 @@ struct wpa_interface * wpa_supplicant_ma
+ return NULL;
+ }
+
+-
+ /**
+ * wpa_supplicant_match_existing - Match existing interfaces
+ * @global: Pointer to global data from wpa_supplicant_init()
+@@ -7122,6 +7121,11 @@ static int wpa_supplicant_match_existing
+
+ #endif /* CONFIG_MATCH_IFACE */
+
++extern void supplicant_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++
++extern void supplicant_event_global(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ /**
+ * wpa_supplicant_add_iface - Add a new network interface
+@@ -7378,6 +7382,8 @@ struct wpa_global * wpa_supplicant_init(
+ #ifndef CONFIG_NO_WPA_MSG
+ wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
+ #endif /* CONFIG_NO_WPA_MSG */
++ wpa_supplicant_event = supplicant_event;
++ wpa_supplicant_event_global = supplicant_event_global;
+
+ if (params->wpa_debug_file_path)
+ wpa_debug_open_file(params->wpa_debug_file_path);
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -591,6 +591,11 @@ fail:
+ return -1;
+ }
+
++void hostapd_wpa_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++
++void hostapd_wpa_event_global(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ #ifdef CONFIG_WPS
+ static int gen_uuid(const char *txt_addr)
+@@ -684,6 +689,8 @@ int main(int argc, char *argv[])
+ return -1;
+ #endif /* CONFIG_DPP */
+
++ wpa_supplicant_event = hostapd_wpa_event;
++ wpa_supplicant_event_global = hostapd_wpa_event_global;
+ for (;;) {
+ c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:q");
+ if (c < 0)
+--- a/src/drivers/drivers.c
++++ b/src/drivers/drivers.c
+@@ -10,6 +10,10 @@
+ #include "utils/common.h"
+ #include "driver.h"
+
++void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ const struct wpa_driver_ops *const wpa_drivers[] =
+ {
+--- a/wpa_supplicant/eapol_test.c
++++ b/wpa_supplicant/eapol_test.c
+@@ -31,7 +31,12 @@
+ #include "ctrl_iface.h"
+ #include "pcsc_funcs.h"
+ #include "wpas_glue.h"
++#include "drivers/driver.h"
+
++void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ const struct wpa_driver_ops *const wpa_drivers[] = { NULL };
+
+@@ -1303,6 +1308,10 @@ static void usage(void)
+ "option several times.\n");
+ }
+
++extern void supplicant_event(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
++extern void supplicant_event_global(void *ctx, enum wpa_event_type event,
++ union wpa_event_data *data);
+
+ int main(int argc, char *argv[])
+ {
+@@ -1323,6 +1332,8 @@ int main(int argc, char *argv[])
+ if (os_program_init())
+ return -1;
+
++ wpa_supplicant_event = supplicant_event;
++ wpa_supplicant_event_global = supplicant_event_global;
+ hostapd_logger_register_cb(hostapd_logger_cb);
+
+ os_memset(&eapol_test, 0, sizeof(eapol_test));
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/300-noscan.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/300-noscan.patch
new file mode 100644
index 0000000..a0e00c4
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/300-noscan.patch
@@ -0,0 +1,58 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3439,6 +3439,10 @@ static int hostapd_config_fill(struct ho
+ if (bss->ocv && !bss->ieee80211w)
+ bss->ieee80211w = 1;
+ #endif /* CONFIG_OCV */
++ } else if (os_strcmp(buf, "noscan") == 0) {
++ conf->noscan = atoi(pos);
++ } else if (os_strcmp(buf, "ht_coex") == 0) {
++ conf->no_ht_coex = !atoi(pos);
+ } else if (os_strcmp(buf, "ieee80211n") == 0) {
+ conf->ieee80211n = atoi(pos);
+ } else if (os_strcmp(buf, "ht_capab") == 0) {
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1043,6 +1043,8 @@ struct hostapd_config {
+
+ int ht_op_mode_fixed;
+ u16 ht_capab;
++ int noscan;
++ int no_ht_coex;
+ int ieee80211n;
+ int secondary_channel;
+ int no_pri_sec_switch;
+--- a/src/ap/hw_features.c
++++ b/src/ap/hw_features.c
+@@ -517,7 +517,8 @@ static int ieee80211n_check_40mhz(struct
+ int ret;
+
+ /* Check that HT40 is used and PRI / SEC switch is allowed */
+- if (!iface->conf->secondary_channel || iface->conf->no_pri_sec_switch)
++ if (!iface->conf->secondary_channel || iface->conf->no_pri_sec_switch ||
++ iface->conf->noscan)
+ return 0;
+
+ hostapd_set_state(iface, HAPD_IFACE_HT_SCAN);
+--- a/src/ap/ieee802_11_ht.c
++++ b/src/ap/ieee802_11_ht.c
+@@ -230,6 +230,9 @@ void hostapd_2040_coex_action(struct hos
+ return;
+ }
+
++ if (iface->conf->noscan || iface->conf->no_ht_coex)
++ return;
++
+ if (len < IEEE80211_HDRLEN + 2 + sizeof(*bc_ie)) {
+ wpa_printf(MSG_DEBUG,
+ "Ignore too short 20/40 BSS Coexistence Management frame");
+@@ -390,6 +393,9 @@ void ht40_intolerant_add(struct hostapd_
+ if (iface->current_mode->mode != HOSTAPD_MODE_IEEE80211G)
+ return;
+
++ if (iface->conf->noscan || iface->conf->no_ht_coex)
++ return;
++
+ wpa_printf(MSG_INFO, "HT: Forty MHz Intolerant is set by STA " MACSTR
+ " in Association Request", MAC2STR(sta->addr));
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/301-mesh-noscan.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/301-mesh-noscan.patch
new file mode 100644
index 0000000..9985401
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/301-mesh-noscan.patch
@@ -0,0 +1,71 @@
+--- a/wpa_supplicant/config.c
++++ b/wpa_supplicant/config.c
+@@ -2555,6 +2555,7 @@ static const struct parse_data ssid_fiel
+ #else /* CONFIG_MESH */
+ { INT_RANGE(mode, 0, 4) },
+ #endif /* CONFIG_MESH */
++ { INT_RANGE(noscan, 0, 1) },
+ { INT_RANGE(proactive_key_caching, 0, 1) },
+ { INT_RANGE(disabled, 0, 2) },
+ { STR(id_str) },
+--- a/wpa_supplicant/config_file.c
++++ b/wpa_supplicant/config_file.c
+@@ -766,6 +766,7 @@ static void wpa_config_write_network(FIL
+ #endif /* IEEE8021X_EAPOL */
+ INT(mode);
+ INT(no_auto_peer);
++ INT(noscan);
+ INT(mesh_fwding);
+ INT(frequency);
+ INT(enable_edmg);
+--- a/wpa_supplicant/mesh.c
++++ b/wpa_supplicant/mesh.c
+@@ -506,6 +506,8 @@ static int wpa_supplicant_mesh_init(stru
+ frequency);
+ goto out_free;
+ }
++ if (ssid->noscan)
++ conf->noscan = 1;
+
+ if (ssid->mesh_basic_rates == NULL) {
+ /*
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -2463,7 +2463,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ int ieee80211_mode = wpas_mode_to_ieee80211_mode(ssid->mode);
+ enum hostapd_hw_mode hw_mode;
+ struct hostapd_hw_modes *mode = NULL;
+- int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
++ int ht40plus[] = { 1, 2, 3, 4, 5, 6, 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
+ 184, 192 };
+ int bw80[] = { 5180, 5260, 5500, 5580, 5660, 5745, 5955,
+ 6035, 6115, 6195, 6275, 6355, 6435, 6515,
+@@ -2471,7 +2471,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ int bw160[] = { 5955, 6115, 6275, 6435, 6595, 6755, 6915 };
+ struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
+ u8 channel;
+- int i, chan_idx, ht40 = -1, res, obss_scan = 1;
++ int i, chan_idx, ht40 = -1, res, obss_scan = !(ssid->noscan);
+ unsigned int j, k;
+ struct hostapd_freq_params vht_freq;
+ int chwidth, seg0, seg1;
+@@ -2562,7 +2562,7 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ #endif /* CONFIG_HE_OVERRIDES */
+
+ /* Setup higher BW only for 5 GHz */
+- if (mode->mode != HOSTAPD_MODE_IEEE80211A)
++ if (mode->mode != HOSTAPD_MODE_IEEE80211A && !(ssid->noscan))
+ return;
+
+ for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
+--- a/wpa_supplicant/config_ssid.h
++++ b/wpa_supplicant/config_ssid.h
+@@ -981,6 +981,8 @@ struct wpa_ssid {
+ */
+ int no_auto_peer;
+
++ int noscan;
++
+ /**
+ * mesh_rssi_threshold - Set mesh parameter mesh_rssi_threshold (dBm)
+ *
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/310-rescan_immediately.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/310-rescan_immediately.patch
new file mode 100644
index 0000000..2c25419
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/310-rescan_immediately.patch
@@ -0,0 +1,11 @@
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -5419,7 +5419,7 @@ wpa_supplicant_alloc(struct wpa_supplica
+ if (wpa_s == NULL)
+ return NULL;
+ wpa_s->scan_req = INITIAL_SCAN_REQ;
+- wpa_s->scan_interval = 5;
++ wpa_s->scan_interval = 1;
+ wpa_s->new_connection = 1;
+ wpa_s->parent = parent ? parent : wpa_s;
+ wpa_s->p2pdev = wpa_s->parent;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/320-optional_rfkill.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/320-optional_rfkill.patch
new file mode 100644
index 0000000..0153779
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/320-optional_rfkill.patch
@@ -0,0 +1,61 @@
+--- a/src/drivers/drivers.mak
++++ b/src/drivers/drivers.mak
+@@ -54,7 +54,6 @@ NEED_SME=y
+ NEED_AP_MLME=y
+ NEED_NETLINK=y
+ NEED_LINUX_IOCTL=y
+-NEED_RFKILL=y
+ NEED_RADIOTAP=y
+ NEED_LIBNL=y
+ endif
+@@ -111,7 +110,6 @@ DRV_WPA_CFLAGS += -DCONFIG_DRIVER_WEXT
+ CONFIG_WIRELESS_EXTENSION=y
+ NEED_NETLINK=y
+ NEED_LINUX_IOCTL=y
+-NEED_RFKILL=y
+ endif
+
+ ifdef CONFIG_DRIVER_NDIS
+@@ -137,7 +135,6 @@ endif
+ ifdef CONFIG_WIRELESS_EXTENSION
+ DRV_WPA_CFLAGS += -DCONFIG_WIRELESS_EXTENSION
+ DRV_WPA_OBJS += ../src/drivers/driver_wext.o
+-NEED_RFKILL=y
+ endif
+
+ ifdef NEED_NETLINK
+@@ -146,6 +143,7 @@ endif
+
+ ifdef NEED_RFKILL
+ DRV_OBJS += ../src/drivers/rfkill.o
++DRV_WPA_CFLAGS += -DCONFIG_RFKILL
+ endif
+
+ ifdef NEED_RADIOTAP
+--- a/src/drivers/rfkill.h
++++ b/src/drivers/rfkill.h
+@@ -18,8 +18,24 @@ struct rfkill_config {
+ void (*unblocked_cb)(void *ctx);
+ };
+
++#ifdef CONFIG_RFKILL
+ struct rfkill_data * rfkill_init(struct rfkill_config *cfg);
+ void rfkill_deinit(struct rfkill_data *rfkill);
+ int rfkill_is_blocked(struct rfkill_data *rfkill);
++#else
++static inline struct rfkill_data * rfkill_init(struct rfkill_config *cfg)
++{
++ return (void *) 1;
++}
++
++static inline void rfkill_deinit(struct rfkill_data *rfkill)
++{
++}
++
++static inline int rfkill_is_blocked(struct rfkill_data *rfkill)
++{
++ return 0;
++}
++#endif
+
+ #endif /* RFKILL_H */
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/330-nl80211_fix_set_freq.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/330-nl80211_fix_set_freq.patch
new file mode 100644
index 0000000..8218a43
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/330-nl80211_fix_set_freq.patch
@@ -0,0 +1,11 @@
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -5022,7 +5022,7 @@ static int nl80211_set_channel(struct i8
+ freq->he_enabled, freq->eht_enabled, freq->bandwidth,
+ freq->center_freq1, freq->center_freq2);
+
+- msg = nl80211_drv_msg(drv, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
++ msg = nl80211_bss_msg(bss, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
+ NL80211_CMD_SET_WIPHY);
+ if (!msg || nl80211_put_freq_params(msg, freq) < 0) {
+ nlmsg_free(msg);
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/340-reload_freq_change.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/340-reload_freq_change.patch
new file mode 100644
index 0000000..b591074
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/340-reload_freq_change.patch
@@ -0,0 +1,76 @@
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -119,6 +119,29 @@ static void hostapd_reload_bss(struct ho
+ #endif /* CONFIG_NO_RADIUS */
+
+ ssid = &hapd->conf->ssid;
++
++ hostapd_set_freq(hapd, hapd->iconf->hw_mode, hapd->iface->freq,
++ hapd->iconf->channel,
++ hapd->iconf->enable_edmg,
++ hapd->iconf->edmg_channel,
++ hapd->iconf->ieee80211n,
++ hapd->iconf->ieee80211ac,
++ hapd->iconf->ieee80211ax,
++ hapd->iconf->ieee80211be,
++ hapd->iconf->secondary_channel,
++ hostapd_get_oper_chwidth(hapd->iconf),
++ hostapd_get_oper_centr_freq_seg0_idx(hapd->iconf),
++ hostapd_get_oper_centr_freq_seg1_idx(hapd->iconf));
++
++ if (hapd->iface->current_mode) {
++ if (hostapd_prepare_rates(hapd->iface, hapd->iface->current_mode)) {
++ wpa_printf(MSG_ERROR, "Failed to prepare rates table.");
++ hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
++ HOSTAPD_LEVEL_WARNING,
++ "Failed to prepare rates table.");
++ }
++ }
++
+ if (!ssid->wpa_psk_set && ssid->wpa_psk && !ssid->wpa_psk->next &&
+ ssid->wpa_passphrase_set && ssid->wpa_passphrase) {
+ /*
+@@ -220,6 +243,7 @@ int hostapd_reload_config(struct hostapd
+ struct hostapd_data *hapd = iface->bss[0];
+ struct hostapd_config *newconf, *oldconf;
+ size_t j;
++ int i;
+
+ if (iface->config_fname == NULL) {
+ /* Only in-memory config in use - assume it has been updated */
+@@ -270,24 +294,20 @@ int hostapd_reload_config(struct hostapd
+ }
+ iface->conf = newconf;
+
++ for (i = 0; i < iface->num_hw_features; i++) {
++ struct hostapd_hw_modes *mode = &iface->hw_features[i];
++ if (mode->mode == iface->conf->hw_mode) {
++ iface->current_mode = mode;
++ break;
++ }
++ }
++
++ if (iface->conf->channel)
++ iface->freq = hostapd_hw_get_freq(hapd, iface->conf->channel);
++
+ for (j = 0; j < iface->num_bss; j++) {
+ hapd = iface->bss[j];
+ hapd->iconf = newconf;
+- hapd->iconf->channel = oldconf->channel;
+- hapd->iconf->acs = oldconf->acs;
+- hapd->iconf->secondary_channel = oldconf->secondary_channel;
+- hapd->iconf->ieee80211n = oldconf->ieee80211n;
+- hapd->iconf->ieee80211ac = oldconf->ieee80211ac;
+- hapd->iconf->ht_capab = oldconf->ht_capab;
+- hapd->iconf->vht_capab = oldconf->vht_capab;
+- hostapd_set_oper_chwidth(hapd->iconf,
+- hostapd_get_oper_chwidth(oldconf));
+- hostapd_set_oper_centr_freq_seg0_idx(
+- hapd->iconf,
+- hostapd_get_oper_centr_freq_seg0_idx(oldconf));
+- hostapd_set_oper_centr_freq_seg1_idx(
+- hapd->iconf,
+- hostapd_get_oper_centr_freq_seg1_idx(oldconf));
+ hapd->conf = newconf->bss[j];
+ hostapd_reload_bss(hapd);
+ }
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/341-mesh-ctrl-iface-channel-switch.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/341-mesh-ctrl-iface-channel-switch.patch
new file mode 100644
index 0000000..29a3799
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/341-mesh-ctrl-iface-channel-switch.patch
@@ -0,0 +1,39 @@
+--- a/wpa_supplicant/ap.c
++++ b/wpa_supplicant/ap.c
+@@ -1803,15 +1803,35 @@ int ap_switch_channel(struct wpa_supplic
+
+
+ #ifdef CONFIG_CTRL_IFACE
++
++static int __ap_ctrl_iface_chanswitch(struct hostapd_iface *iface,
++ struct csa_settings *settings)
++{
++#ifdef NEED_AP_MLME
++ if (!iface || !iface->bss[0])
++ return 0;
++
++ return hostapd_switch_channel(iface->bss[0], settings);
++#else
++ return -1;
++#endif
++}
++
++
+ int ap_ctrl_iface_chanswitch(struct wpa_supplicant *wpa_s, const char *pos)
+ {
+ struct csa_settings settings;
+ int ret = hostapd_parse_csa_settings(pos, &settings);
+
++ if (!(wpa_s->ap_iface && wpa_s->ap_iface->bss[0]) &&
++ !(wpa_s->ifmsh && wpa_s->ifmsh->bss[0]))
++ return -1;
++
++ ret = __ap_ctrl_iface_chanswitch(wpa_s->ap_iface, &settings);
+ if (ret)
+ return ret;
+
+- return ap_switch_channel(wpa_s, &settings);
++ return __ap_ctrl_iface_chanswitch(wpa_s->ifmsh, &settings);
+ }
+ #endif /* CONFIG_CTRL_IFACE */
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/350-nl80211_del_beacon_bss.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/350-nl80211_del_beacon_bss.patch
new file mode 100644
index 0000000..85298df
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/350-nl80211_del_beacon_bss.patch
@@ -0,0 +1,34 @@
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -2938,11 +2938,11 @@ static int wpa_driver_nl80211_del_beacon
+ struct wpa_driver_nl80211_data *drv = bss->drv;
+
+ wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
+- drv->ifindex);
++ bss->ifindex);
+ bss->beacon_set = 0;
+ bss->freq = 0;
+ nl80211_put_wiphy_data_ap(bss);
+- msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
++ msg = nl80211_bss_msg(drv, 0, NL80211_CMD_DEL_BEACON);
+ return send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
+ }
+
+@@ -5661,7 +5661,7 @@ static void nl80211_teardown_ap(struct i
+ nl80211_mgmt_unsubscribe(bss, "AP teardown");
+
+ nl80211_put_wiphy_data_ap(bss);
+- bss->beacon_set = 0;
++ wpa_driver_nl80211_del_beacon(bss);
+ }
+
+
+@@ -8120,8 +8120,6 @@ static int wpa_driver_nl80211_if_remove(
+ } else {
+ wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
+ nl80211_teardown_ap(bss);
+- if (!bss->added_if && !drv->first_bss->next)
+- wpa_driver_nl80211_del_beacon(bss);
+ nl80211_destroy_bss(bss);
+ if (!bss->added_if)
+ i802_set_iface_flags(bss, 0);
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/360-ctrl_iface_reload.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/360-ctrl_iface_reload.patch
new file mode 100644
index 0000000..7699541
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/360-ctrl_iface_reload.patch
@@ -0,0 +1,106 @@
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -67,6 +67,7 @@
+ #include "fst/fst_ctrl_iface.h"
+ #include "config_file.h"
+ #include "ctrl_iface.h"
++#include "config_file.h"
+
+
+ #define HOSTAPD_CLI_DUP_VALUE_MAX_LEN 256
+@@ -82,6 +83,7 @@ static void hostapd_ctrl_iface_send(stru
+ enum wpa_msg_type type,
+ const char *buf, size_t len);
+
++static char *reload_opts = NULL;
+
+ static int hostapd_ctrl_iface_attach(struct hostapd_data *hapd,
+ struct sockaddr_storage *from,
+@@ -133,6 +135,61 @@ static int hostapd_ctrl_iface_new_sta(st
+ return 0;
+ }
+
++static char *get_option(char *opt, char *str)
++{
++ int len = strlen(str);
++
++ if (!strncmp(opt, str, len))
++ return opt + len;
++ else
++ return NULL;
++}
++
++static struct hostapd_config *hostapd_ctrl_iface_config_read(const char *fname)
++{
++ struct hostapd_config *conf;
++ char *opt, *val;
++
++ conf = hostapd_config_read(fname);
++ if (!conf)
++ return NULL;
++
++ for (opt = strtok(reload_opts, " ");
++ opt;
++ opt = strtok(NULL, " ")) {
++
++ if ((val = get_option(opt, "channel=")))
++ conf->channel = atoi(val);
++ else if ((val = get_option(opt, "ht_capab=")))
++ conf->ht_capab = atoi(val);
++ else if ((val = get_option(opt, "ht_capab_mask=")))
++ conf->ht_capab &= atoi(val);
++ else if ((val = get_option(opt, "sec_chan=")))
++ conf->secondary_channel = atoi(val);
++ else if ((val = get_option(opt, "hw_mode=")))
++ conf->hw_mode = atoi(val);
++ else if ((val = get_option(opt, "ieee80211n=")))
++ conf->ieee80211n = atoi(val);
++ else
++ break;
++ }
++
++ return conf;
++}
++
++static int hostapd_ctrl_iface_update(struct hostapd_data *hapd, char *txt)
++{
++ struct hostapd_config * (*config_read_cb)(const char *config_fname);
++ struct hostapd_iface *iface = hapd->iface;
++
++ config_read_cb = iface->interfaces->config_read_cb;
++ iface->interfaces->config_read_cb = hostapd_ctrl_iface_config_read;
++ reload_opts = txt;
++
++ hostapd_reload_config(iface);
++
++ iface->interfaces->config_read_cb = config_read_cb;
++}
+
+ #ifdef NEED_AP_MLME
+ static int hostapd_ctrl_iface_sa_query(struct hostapd_data *hapd,
+@@ -3449,6 +3506,8 @@ static int hostapd_ctrl_iface_receive_pr
+ } else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
+ reply_len = hostapd_ctrl_iface_vendor(hapd, buf + 7, reply,
+ reply_size);
++ } else if (os_strncmp(buf, "UPDATE ", 7) == 0) {
++ hostapd_ctrl_iface_update(hapd, buf + 7);
+ } else if (os_strcmp(buf, "ERP_FLUSH") == 0) {
+ ieee802_1x_erp_flush(hapd);
+ #ifdef RADIUS_SERVER
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -945,7 +945,13 @@ int hostapd_parse_csa_settings(const cha
+
+ int hostapd_ctrl_iface_stop_ap(struct hostapd_data *hapd)
+ {
+- return hostapd_drv_stop_ap(hapd);
++ struct hostapd_iface *iface = hapd->iface;
++ int i;
++
++ for (i = 0; i < iface->num_bss; i++)
++ hostapd_drv_stop_ap(iface->bss[i]);
++
++ return 0;
+ }
+
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/370-ap_sta_support.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/370-ap_sta_support.patch
new file mode 100644
index 0000000..6faaffc
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/370-ap_sta_support.patch
@@ -0,0 +1,393 @@
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -115,6 +115,8 @@ OBJS_c += ../src/utils/common.o
+ OBJS_c += ../src/common/cli.o
+ OBJS += wmm_ac.o
+
++OBJS += ../src/common/wpa_ctrl.o
++
+ ifndef CONFIG_OS
+ ifdef CONFIG_NATIVE_WINDOWS
+ CONFIG_OS=win32
+--- a/wpa_supplicant/bss.c
++++ b/wpa_supplicant/bss.c
+@@ -11,6 +11,7 @@
+ #include "utils/common.h"
+ #include "utils/eloop.h"
+ #include "common/ieee802_11_defs.h"
++#include "common/ieee802_11_common.h"
+ #include "drivers/driver.h"
+ #include "eap_peer/eap.h"
+ #include "wpa_supplicant_i.h"
+@@ -282,6 +283,10 @@ void calculate_update_time(const struct
+ static void wpa_bss_copy_res(struct wpa_bss *dst, struct wpa_scan_res *src,
+ struct os_reltime *fetch_time)
+ {
++ struct ieee80211_ht_capabilities *capab;
++ struct ieee80211_ht_operation *oper;
++ struct ieee802_11_elems elems;
++
+ dst->flags = src->flags;
+ os_memcpy(dst->bssid, src->bssid, ETH_ALEN);
+ dst->freq = src->freq;
+@@ -295,6 +300,15 @@ static void wpa_bss_copy_res(struct wpa_
+ dst->est_throughput = src->est_throughput;
+ dst->snr = src->snr;
+
++ memset(&elems, 0, sizeof(elems));
++ ieee802_11_parse_elems((u8 *) (src + 1), src->ie_len, &elems, 0);
++ capab = (struct ieee80211_ht_capabilities *) elems.ht_capabilities;
++ oper = (struct ieee80211_ht_operation *) elems.ht_operation;
++ if (capab)
++ dst->ht_capab = le_to_host16(capab->ht_capabilities_info);
++ if (oper)
++ dst->ht_param = oper->ht_param;
++
+ calculate_update_time(fetch_time, src->age, &dst->last_update);
+ }
+
+--- a/wpa_supplicant/bss.h
++++ b/wpa_supplicant/bss.h
+@@ -94,6 +94,10 @@ struct wpa_bss {
+ u8 ssid[SSID_MAX_LEN];
+ /** Length of SSID */
+ size_t ssid_len;
++ /** HT capabilities */
++ u16 ht_capab;
++ /* Five octets of HT Operation Information */
++ u8 ht_param;
+ /** Frequency of the channel in MHz (e.g., 2412 = channel 1) */
+ int freq;
+ /** Beacon interval in TUs (host byte order) */
+--- a/wpa_supplicant/main.c
++++ b/wpa_supplicant/main.c
+@@ -35,7 +35,7 @@ static void usage(void)
+ "vW] [-P<pid file>] "
+ "[-g<global ctrl>] \\\n"
+ " [-G<group>] \\\n"
+- " -i<ifname> -c<config file> [-C<ctrl>] [-D<driver>] "
++ " -i<ifname> -c<config file> [-C<ctrl>] [-D<driver>] [-H<hostapd path>] "
+ "[-p<driver_param>] \\\n"
+ " [-b<br_ifname>] [-e<entropy file>]"
+ #ifdef CONFIG_DEBUG_FILE
+@@ -75,6 +75,7 @@ static void usage(void)
+ " -g = global ctrl_interface\n"
+ " -G = global ctrl_interface group\n"
+ " -h = show this help text\n"
++ " -H = connect to a hostapd instance to manage state changes\n"
+ " -i = interface name\n"
+ " -I = additional configuration file\n"
+ " -K = include keys (passwords, etc.) in debug output\n"
+@@ -202,7 +203,7 @@ int main(int argc, char *argv[])
+
+ for (;;) {
+ c = getopt(argc, argv,
+- "b:Bc:C:D:de:f:g:G:hi:I:KLMm:No:O:p:P:qsTtuvW");
++ "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuvW");
+ if (c < 0)
+ break;
+ switch (c) {
+@@ -249,6 +250,9 @@ int main(int argc, char *argv[])
+ usage();
+ exitcode = 0;
+ goto out;
++ case 'H':
++ iface->hostapd_ctrl = optarg;
++ break;
+ case 'i':
+ iface->ifname = optarg;
+ break;
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -131,6 +131,54 @@ static void wpas_update_fils_connect_par
+ static void wpas_update_owe_connect_params(struct wpa_supplicant *wpa_s);
+ #endif /* CONFIG_OWE */
+
++static int hostapd_stop(struct wpa_supplicant *wpa_s)
++{
++ const char *cmd = "STOP_AP";
++ char buf[256];
++ size_t len = sizeof(buf);
++
++ if (wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL) < 0) {
++ wpa_printf(MSG_ERROR, "\nFailed to stop hostapd AP interfaces\n");
++ return -1;
++ }
++ return 0;
++}
++
++static int hostapd_reload(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
++{
++ char *cmd = NULL;
++ char buf[256];
++ size_t len = sizeof(buf);
++ enum hostapd_hw_mode hw_mode;
++ u8 channel;
++ int sec_chan = 0;
++ int ret;
++
++ if (!bss)
++ return -1;
++
++ if (bss->ht_param & HT_INFO_HT_PARAM_STA_CHNL_WIDTH) {
++ int sec = bss->ht_param & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
++ if (sec == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
++ sec_chan = 1;
++ else if (sec == HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
++ sec_chan = -1;
++ }
++
++ hw_mode = ieee80211_freq_to_chan(bss->freq, &channel);
++ if (asprintf(&cmd, "UPDATE channel=%d sec_chan=%d hw_mode=%d",
++ channel, sec_chan, hw_mode) < 0)
++ return -1;
++
++ ret = wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL);
++ free(cmd);
++
++ if (ret < 0) {
++ wpa_printf(MSG_ERROR, "\nFailed to reload hostapd AP interfaces\n");
++ return -1;
++ }
++ return 0;
++}
+
+ #ifdef CONFIG_WEP
+ /* Configure default/group WEP keys for static WEP */
+@@ -1016,6 +1064,8 @@ void wpa_supplicant_set_state(struct wpa
+
+ sme_sched_obss_scan(wpa_s, 1);
+
++ if (wpa_s->hostapd)
++ hostapd_reload(wpa_s, wpa_s->current_bss);
+ #if defined(CONFIG_FILS) && defined(IEEE8021X_EAPOL)
+ if (!fils_hlp_sent && ssid && ssid->eap.erp)
+ update_fils_connect_params = true;
+@@ -1026,6 +1076,8 @@ void wpa_supplicant_set_state(struct wpa
+ #endif /* CONFIG_OWE */
+ } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
+ state == WPA_ASSOCIATED) {
++ if (wpa_s->hostapd)
++ hostapd_stop(wpa_s);
+ wpa_s->new_connection = 1;
+ wpa_drv_set_operstate(wpa_s, 0);
+ #ifndef IEEE8021X_EAPOL
+@@ -2335,6 +2387,8 @@ void wpa_supplicant_associate(struct wpa
+ return;
+ }
+ wpa_s->current_bss = bss;
++ if (wpa_s->hostapd)
++ hostapd_reload(wpa_s, wpa_s->current_bss);
+ #else /* CONFIG_MESH */
+ wpa_msg(wpa_s, MSG_ERROR,
+ "mesh mode support not included in the build");
+@@ -6693,6 +6747,16 @@ static int wpa_supplicant_init_iface(str
+ sizeof(wpa_s->bridge_ifname));
+ }
+
++ if (iface->hostapd_ctrl) {
++ wpa_s->hostapd = wpa_ctrl_open(iface->hostapd_ctrl);
++ if (!wpa_s->hostapd) {
++ wpa_printf(MSG_ERROR, "\nFailed to connect to hostapd\n");
++ return -1;
++ }
++ if (hostapd_stop(wpa_s) < 0)
++ return -1;
++ }
++
+ /* RSNA Supplicant Key Management - INITIALIZE */
+ eapol_sm_notify_portEnabled(wpa_s->eapol, false);
+ eapol_sm_notify_portValid(wpa_s->eapol, false);
+@@ -7031,6 +7095,11 @@ static void wpa_supplicant_deinit_iface(
+ if (terminate)
+ wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
+
++ if (wpa_s->hostapd) {
++ wpa_ctrl_close(wpa_s->hostapd);
++ wpa_s->hostapd = NULL;
++ }
++
+ wpa_supplicant_ctrl_iface_deinit(wpa_s, wpa_s->ctrl_iface);
+ wpa_s->ctrl_iface = NULL;
+
+--- a/wpa_supplicant/wpa_supplicant_i.h
++++ b/wpa_supplicant/wpa_supplicant_i.h
+@@ -105,6 +105,11 @@ struct wpa_interface {
+ const char *ifname;
+
+ /**
++ * hostapd_ctrl - path to hostapd control socket for notification
++ */
++ const char *hostapd_ctrl;
++
++ /**
+ * bridge_ifname - Optional bridge interface name
+ *
+ * If the driver interface (ifname) is included in a Linux bridge
+@@ -717,6 +722,8 @@ struct wpa_supplicant {
+ #endif /* CONFIG_CTRL_IFACE_BINDER */
+ char bridge_ifname[16];
+
++ struct wpa_ctrl *hostapd;
++
+ char *confname;
+ char *confanother;
+
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -2641,6 +2641,12 @@ static int hostapd_ctrl_iface_chan_switc
+ return 0;
+ }
+
++ if (os_strstr(pos, " auto-ht")) {
++ settings.freq_params.ht_enabled = iface->conf->ieee80211n;
++ settings.freq_params.vht_enabled = iface->conf->ieee80211ac;
++ settings.freq_params.he_enabled = iface->conf->ieee80211ax;
++ }
++
+ for (i = 0; i < iface->num_bss; i++) {
+
+ /* Save CHAN_SWITCH VHT, HE, and EHT config */
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1903,11 +1903,6 @@ static int __ieee802_11_set_beacon(struc
+ return -1;
+ }
+
+- if (hapd->csa_in_progress) {
+- wpa_printf(MSG_ERROR, "Cannot set beacons during CSA period");
+- return -1;
+- }
+-
+ hapd->beacon_set_done = 1;
+
+ if (ieee802_11_build_ap_params(hapd, ¶ms) < 0)
+--- a/wpa_supplicant/events.c
++++ b/wpa_supplicant/events.c
+@@ -4953,6 +4953,60 @@ static void wpas_event_unprot_beacon(str
+ }
+
+
++static void
++supplicant_ch_switch_started(struct wpa_supplicant *wpa_s,
++ union wpa_event_data *data)
++{
++ char buf[256];
++ size_t len = sizeof(buf);
++ char *cmd = NULL;
++ int width = 20;
++ int ret;
++
++ if (!wpa_s->hostapd)
++ return;
++
++ wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CHANNEL_SWITCH
++ "count=%d freq=%d ht_enabled=%d ch_offset=%d ch_width=%s cf1=%d cf2=%d",
++ data->ch_switch.count,
++ data->ch_switch.freq,
++ data->ch_switch.ht_enabled,
++ data->ch_switch.ch_offset,
++ channel_width_to_string(data->ch_switch.ch_width),
++ data->ch_switch.cf1,
++ data->ch_switch.cf2);
++
++ switch (data->ch_switch.ch_width) {
++ case CHAN_WIDTH_20_NOHT:
++ case CHAN_WIDTH_20:
++ width = 20;
++ break;
++ case CHAN_WIDTH_40:
++ width = 40;
++ break;
++ case CHAN_WIDTH_80:
++ width = 80;
++ break;
++ case CHAN_WIDTH_160:
++ case CHAN_WIDTH_80P80:
++ width = 160;
++ break;
++ }
++
++ asprintf(&cmd, "CHAN_SWITCH %d %d sec_channel_offset=%d center_freq1=%d center_freq2=%d, bandwidth=%d auto-ht\n",
++ data->ch_switch.count - 1,
++ data->ch_switch.freq,
++ data->ch_switch.ch_offset,
++ data->ch_switch.cf1,
++ data->ch_switch.cf2,
++ width);
++ ret = wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL);
++ free(cmd);
++
++ if (ret < 0)
++ wpa_printf(MSG_ERROR, "\nFailed to reload hostapd AP interfaces\n");
++}
++
+ void supplicant_event(void *ctx, enum wpa_event_type event,
+ union wpa_event_data *data)
+ {
+@@ -5268,8 +5322,10 @@ void supplicant_event(void *ctx, enum wp
+ channel_width_to_string(data->ch_switch.ch_width),
+ data->ch_switch.cf1,
+ data->ch_switch.cf2);
+- if (event == EVENT_CH_SWITCH_STARTED)
++ if (event == EVENT_CH_SWITCH_STARTED) {
++ supplicant_ch_switch_started(wpa_s, data);
+ break;
++ }
+
+ wpa_s->assoc_freq = data->ch_switch.freq;
+ wpa_s->current_ssid->frequency = data->ch_switch.freq;
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -5968,6 +5968,7 @@ union wpa_event_data {
+
+ /**
+ * struct ch_switch
++ * @count: Count until channel switch activates
+ * @freq: Frequency of new channel in MHz
+ * @ht_enabled: Whether this is an HT channel
+ * @ch_offset: Secondary channel offset
+@@ -5976,6 +5977,7 @@ union wpa_event_data {
+ * @cf2: Center frequency 2
+ */
+ struct ch_switch {
++ int count;
+ int freq;
+ int ht_enabled;
+ int ch_offset;
+--- a/src/drivers/driver_nl80211_event.c
++++ b/src/drivers/driver_nl80211_event.c
+@@ -694,7 +694,7 @@ static void mlme_event_ch_switch(struct
+ struct nlattr *ifindex, struct nlattr *freq,
+ struct nlattr *type, struct nlattr *bw,
+ struct nlattr *cf1, struct nlattr *cf2,
+- int finished)
++ struct nlattr *count, int finished)
+ {
+ struct i802_bss *bss;
+ union wpa_event_data data;
+@@ -755,6 +755,8 @@ static void mlme_event_ch_switch(struct
+ data.ch_switch.cf1 = nla_get_u32(cf1);
+ if (cf2)
+ data.ch_switch.cf2 = nla_get_u32(cf2);
++ if (count)
++ data.ch_switch.count = nla_get_u32(count);
+
+ if (finished)
+ bss->freq = data.ch_switch.freq;
+@@ -3113,6 +3115,7 @@ static void do_process_drv_event(struct
+ tb[NL80211_ATTR_CHANNEL_WIDTH],
+ tb[NL80211_ATTR_CENTER_FREQ1],
+ tb[NL80211_ATTR_CENTER_FREQ2],
++ tb[NL80211_ATTR_CH_SWITCH_COUNT],
+ 0);
+ break;
+ case NL80211_CMD_CH_SWITCH_NOTIFY:
+@@ -3123,6 +3126,7 @@ static void do_process_drv_event(struct
+ tb[NL80211_ATTR_CHANNEL_WIDTH],
+ tb[NL80211_ATTR_CENTER_FREQ1],
+ tb[NL80211_ATTR_CENTER_FREQ2],
++ NULL,
+ 1);
+ break;
+ case NL80211_CMD_DISCONNECT:
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/380-disable_ctrl_iface_mib.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/380-disable_ctrl_iface_mib.patch
new file mode 100644
index 0000000..1f78c42
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/380-disable_ctrl_iface_mib.patch
@@ -0,0 +1,193 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -221,6 +221,9 @@ endif
+ ifdef CONFIG_NO_CTRL_IFACE
+ CFLAGS += -DCONFIG_NO_CTRL_IFACE
+ else
++ifdef CONFIG_CTRL_IFACE_MIB
++CFLAGS += -DCONFIG_CTRL_IFACE_MIB
++endif
+ ifeq ($(CONFIG_CTRL_IFACE), udp)
+ CFLAGS += -DCONFIG_CTRL_IFACE_UDP
+ else
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3265,6 +3265,7 @@ static int hostapd_ctrl_iface_receive_pr
+ reply_size);
+ } else if (os_strcmp(buf, "STATUS-DRIVER") == 0) {
+ reply_len = hostapd_drv_status(hapd, reply, reply_size);
++#ifdef CONFIG_CTRL_IFACE_MIB
+ } else if (os_strcmp(buf, "MIB") == 0) {
+ reply_len = ieee802_11_get_mib(hapd, reply, reply_size);
+ if (reply_len >= 0) {
+@@ -3306,6 +3307,7 @@ static int hostapd_ctrl_iface_receive_pr
+ } else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
+ reply_len = hostapd_ctrl_iface_sta_next(hapd, buf + 9, reply,
+ reply_size);
++#endif
+ } else if (os_strcmp(buf, "ATTACH") == 0) {
+ if (hostapd_ctrl_iface_attach(hapd, from, fromlen, NULL))
+ reply_len = -1;
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -973,6 +973,9 @@ ifdef CONFIG_FILS
+ OBJS += ../src/ap/fils_hlp.o
+ endif
+ ifdef CONFIG_CTRL_IFACE
++ifdef CONFIG_CTRL_IFACE_MIB
++CFLAGS += -DCONFIG_CTRL_IFACE_MIB
++endif
+ OBJS += ../src/ap/ctrl_iface_ap.o
+ endif
+
+--- a/wpa_supplicant/ctrl_iface.c
++++ b/wpa_supplicant/ctrl_iface.c
+@@ -2325,7 +2325,7 @@ static int wpa_supplicant_ctrl_iface_sta
+ pos += ret;
+ }
+
+-#ifdef CONFIG_AP
++#if defined(CONFIG_AP) && defined(CONFIG_CTRL_IFACE_MIB)
+ if (wpa_s->ap_iface) {
+ pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
+ end - pos,
+@@ -11565,6 +11565,7 @@ char * wpa_supplicant_ctrl_iface_process
+ reply_len = -1;
+ } else if (os_strncmp(buf, "NOTE ", 5) == 0) {
+ wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
++#ifdef CONFIG_CTRL_IFACE_MIB
+ } else if (os_strcmp(buf, "MIB") == 0) {
+ reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
+ if (reply_len >= 0) {
+@@ -11577,6 +11578,7 @@ char * wpa_supplicant_ctrl_iface_process
+ reply_size - reply_len);
+ #endif /* CONFIG_MACSEC */
+ }
++#endif
+ } else if (os_strncmp(buf, "STATUS", 6) == 0) {
+ reply_len = wpa_supplicant_ctrl_iface_status(
+ wpa_s, buf + 6, reply, reply_size);
+@@ -12065,6 +12067,7 @@ char * wpa_supplicant_ctrl_iface_process
+ reply_len = wpa_supplicant_ctrl_iface_bss(
+ wpa_s, buf + 4, reply, reply_size);
+ #ifdef CONFIG_AP
++#ifdef CONFIG_CTRL_IFACE_MIB
+ } else if (os_strcmp(buf, "STA-FIRST") == 0) {
+ reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
+ } else if (os_strncmp(buf, "STA ", 4) == 0) {
+@@ -12073,12 +12076,15 @@ char * wpa_supplicant_ctrl_iface_process
+ } else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
+ reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
+ reply_size);
++#endif
++#ifdef CONFIG_CTRL_IFACE_MIB
+ } else if (os_strncmp(buf, "DEAUTHENTICATE ", 15) == 0) {
+ if (ap_ctrl_iface_sta_deauthenticate(wpa_s, buf + 15))
+ reply_len = -1;
+ } else if (os_strncmp(buf, "DISASSOCIATE ", 13) == 0) {
+ if (ap_ctrl_iface_sta_disassociate(wpa_s, buf + 13))
+ reply_len = -1;
++#endif
+ } else if (os_strncmp(buf, "CHAN_SWITCH ", 12) == 0) {
+ if (ap_ctrl_iface_chanswitch(wpa_s, buf + 12))
+ reply_len = -1;
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -26,6 +26,7 @@
+ #include "taxonomy.h"
+ #include "wnm_ap.h"
+
++#ifdef CONFIG_CTRL_IFACE_MIB
+
+ static size_t hostapd_write_ht_mcs_bitmask(char *buf, size_t buflen,
+ size_t curr_len, const u8 *mcs_set)
+@@ -460,6 +461,7 @@ int hostapd_ctrl_iface_sta_next(struct h
+ return hostapd_ctrl_iface_sta_mib(hapd, sta->next, buf, buflen);
+ }
+
++#endif
+
+ #ifdef CONFIG_P2P_MANAGER
+ static int p2p_manager_disconnect(struct hostapd_data *hapd, u16 stype,
+@@ -832,12 +834,12 @@ int hostapd_ctrl_iface_status(struct hos
+ return len;
+ len += ret;
+ }
+-
++#ifdef CONFIG_CTRL_IFACE_MIB
+ if (iface->conf->ieee80211n && !hapd->conf->disable_11n && mode) {
+ len = hostapd_write_ht_mcs_bitmask(buf, buflen, len,
+ mode->mcs_set);
+ }
+-
++#endif /* CONFIG_CTRL_IFACE_MIB */
+ if (iface->current_rates && iface->num_rates) {
+ ret = os_snprintf(buf + len, buflen - len, "supported_rates=");
+ if (os_snprintf_error(buflen - len, ret))
+--- a/src/ap/ieee802_1x.c
++++ b/src/ap/ieee802_1x.c
+@@ -2740,6 +2740,7 @@ static const char * bool_txt(bool val)
+ return val ? "TRUE" : "FALSE";
+ }
+
++#ifdef CONFIG_CTRL_IFACE_MIB
+
+ int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
+ {
+@@ -2926,6 +2927,7 @@ int ieee802_1x_get_mib_sta(struct hostap
+ return len;
+ }
+
++#endif
+
+ #ifdef CONFIG_HS20
+ static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx)
+--- a/src/ap/wpa_auth.c
++++ b/src/ap/wpa_auth.c
+@@ -4559,6 +4559,7 @@ static const char * wpa_bool_txt(int val
+ return val ? "TRUE" : "FALSE";
+ }
+
++#ifdef CONFIG_CTRL_IFACE_MIB
+
+ #define RSN_SUITE "%02x-%02x-%02x-%d"
+ #define RSN_SUITE_ARG(s) \
+@@ -4709,7 +4710,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
+
+ return len;
+ }
+-
++#endif
+
+ void wpa_auth_countermeasures_start(struct wpa_authenticator *wpa_auth)
+ {
+--- a/src/rsn_supp/wpa.c
++++ b/src/rsn_supp/wpa.c
+@@ -2802,6 +2802,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
+ }
+
+
++#ifdef CONFIG_CTRL_IFACE_MIB
++
+ #define RSN_SUITE "%02x-%02x-%02x-%d"
+ #define RSN_SUITE_ARG(s) \
+ ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
+@@ -2883,6 +2885,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
+
+ return (int) len;
+ }
++#endif
+ #endif /* CONFIG_CTRL_IFACE */
+
+
+--- a/wpa_supplicant/ap.c
++++ b/wpa_supplicant/ap.c
+@@ -1477,7 +1477,7 @@ int wpas_ap_wps_nfc_report_handover(stru
+ #endif /* CONFIG_WPS */
+
+
+-#ifdef CONFIG_CTRL_IFACE
++#if defined(CONFIG_CTRL_IFACE) && defined(CONFIG_CTRL_IFACE_MIB)
+
+ int ap_ctrl_iface_sta_first(struct wpa_supplicant *wpa_s,
+ char *buf, size_t buflen)
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/381-hostapd_cli_UNKNOWN-COMMAND.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/381-hostapd_cli_UNKNOWN-COMMAND.patch
new file mode 100644
index 0000000..d2414fa
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/381-hostapd_cli_UNKNOWN-COMMAND.patch
@@ -0,0 +1,11 @@
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -744,7 +744,7 @@ static int wpa_ctrl_command_sta(struct w
+ }
+
+ buf[len] = '\0';
+- if (memcmp(buf, "FAIL", 4) == 0)
++ if (memcmp(buf, "FAIL", 4) == 0 || memcmp(buf, "UNKNOWN COMMAND", 15) == 0)
+ return -1;
+ if (print)
+ printf("%s", buf);
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/390-wpa_ie_cap_workaround.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/390-wpa_ie_cap_workaround.patch
new file mode 100644
index 0000000..bf481c3
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/390-wpa_ie_cap_workaround.patch
@@ -0,0 +1,56 @@
+--- a/src/common/wpa_common.c
++++ b/src/common/wpa_common.c
+@@ -2529,6 +2529,31 @@ u32 wpa_akm_to_suite(int akm)
+ }
+
+
++static void wpa_fixup_wpa_ie_rsn(u8 *assoc_ie, const u8 *wpa_msg_ie,
++ size_t rsn_ie_len)
++{
++ int pos, count;
++
++ pos = sizeof(struct rsn_ie_hdr) + RSN_SELECTOR_LEN;
++ if (rsn_ie_len < pos + 2)
++ return;
++
++ count = WPA_GET_LE16(wpa_msg_ie + pos);
++ pos += 2 + count * RSN_SELECTOR_LEN;
++ if (rsn_ie_len < pos + 2)
++ return;
++
++ count = WPA_GET_LE16(wpa_msg_ie + pos);
++ pos += 2 + count * RSN_SELECTOR_LEN;
++ if (rsn_ie_len < pos + 2)
++ return;
++
++ if (!assoc_ie[pos] && !assoc_ie[pos + 1] &&
++ (wpa_msg_ie[pos] || wpa_msg_ie[pos + 1]))
++ memcpy(&assoc_ie[pos], &wpa_msg_ie[pos], 2);
++}
++
++
+ int wpa_compare_rsn_ie(int ft_initial_assoc,
+ const u8 *ie1, size_t ie1len,
+ const u8 *ie2, size_t ie2len)
+@@ -2536,8 +2561,19 @@ int wpa_compare_rsn_ie(int ft_initial_as
+ if (ie1 == NULL || ie2 == NULL)
+ return -1;
+
+- if (ie1len == ie2len && os_memcmp(ie1, ie2, ie1len) == 0)
+- return 0; /* identical IEs */
++ if (ie1len == ie2len) {
++ u8 *ie_tmp;
++
++ if (os_memcmp(ie1, ie2, ie1len) == 0)
++ return 0; /* identical IEs */
++
++ ie_tmp = alloca(ie1len);
++ memcpy(ie_tmp, ie1, ie1len);
++ wpa_fixup_wpa_ie_rsn(ie_tmp, ie2, ie1len);
++
++ if (os_memcmp(ie_tmp, ie2, ie1len) == 0)
++ return 0; /* only mismatch in RSN capabilties */
++ }
+
+ #ifdef CONFIG_IEEE80211R
+ if (ft_initial_assoc) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/400-wps_single_auth_enc_type.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/400-wps_single_auth_enc_type.patch
new file mode 100644
index 0000000..edcd985
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/400-wps_single_auth_enc_type.patch
@@ -0,0 +1,23 @@
+--- a/src/ap/wps_hostapd.c
++++ b/src/ap/wps_hostapd.c
+@@ -394,9 +394,8 @@ static int hapd_wps_reconfig_in_memory(s
+ bss->wpa_pairwise |= WPA_CIPHER_GCMP;
+ else
+ bss->wpa_pairwise |= WPA_CIPHER_CCMP;
+- }
+ #ifndef CONFIG_NO_TKIP
+- if (cred->encr_type & WPS_ENCR_TKIP)
++ } else if (cred->encr_type & WPS_ENCR_TKIP)
+ bss->wpa_pairwise |= WPA_CIPHER_TKIP;
+ #endif /* CONFIG_NO_TKIP */
+ bss->rsn_pairwise = bss->wpa_pairwise;
+@@ -1181,8 +1180,7 @@ int hostapd_init_wps(struct hostapd_data
+ WPA_CIPHER_GCMP_256)) {
+ wps->encr_types |= WPS_ENCR_AES;
+ wps->encr_types_rsn |= WPS_ENCR_AES;
+- }
+- if (conf->rsn_pairwise & WPA_CIPHER_TKIP) {
++ } else if (conf->rsn_pairwise & WPA_CIPHER_TKIP) {
+ #ifdef CONFIG_NO_TKIP
+ wpa_printf(MSG_INFO, "WPS: TKIP not supported");
+ goto fail;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/410-limit_debug_messages.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/410-limit_debug_messages.patch
new file mode 100644
index 0000000..d2713fc
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/410-limit_debug_messages.patch
@@ -0,0 +1,210 @@
+--- a/src/utils/wpa_debug.c
++++ b/src/utils/wpa_debug.c
+@@ -206,7 +206,7 @@ void wpa_debug_close_linux_tracing(void)
+ *
+ * Note: New line '\n' is added to the end of the text when printing to stdout.
+ */
+-void wpa_printf(int level, const char *fmt, ...)
++void _wpa_printf(int level, const char *fmt, ...)
+ {
+ va_list ap;
+
+@@ -255,7 +255,7 @@ void wpa_printf(int level, const char *f
+ }
+
+
+-static void _wpa_hexdump(int level, const char *title, const u8 *buf,
++void _wpa_hexdump(int level, const char *title, const u8 *buf,
+ size_t len, int show, int only_syslog)
+ {
+ size_t i;
+@@ -382,19 +382,7 @@ static void _wpa_hexdump(int level, cons
+ #endif /* CONFIG_ANDROID_LOG */
+ }
+
+-void wpa_hexdump(int level, const char *title, const void *buf, size_t len)
+-{
+- _wpa_hexdump(level, title, buf, len, 1, 0);
+-}
+-
+-
+-void wpa_hexdump_key(int level, const char *title, const void *buf, size_t len)
+-{
+- _wpa_hexdump(level, title, buf, len, wpa_debug_show_keys, 0);
+-}
+-
+-
+-static void _wpa_hexdump_ascii(int level, const char *title, const void *buf,
++void _wpa_hexdump_ascii(int level, const char *title, const void *buf,
+ size_t len, int show)
+ {
+ size_t i, llen;
+@@ -507,20 +495,6 @@ file_done:
+ }
+
+
+-void wpa_hexdump_ascii(int level, const char *title, const void *buf,
+- size_t len)
+-{
+- _wpa_hexdump_ascii(level, title, buf, len, 1);
+-}
+-
+-
+-void wpa_hexdump_ascii_key(int level, const char *title, const void *buf,
+- size_t len)
+-{
+- _wpa_hexdump_ascii(level, title, buf, len, wpa_debug_show_keys);
+-}
+-
+-
+ #ifdef CONFIG_DEBUG_FILE
+ static char *last_path = NULL;
+ #endif /* CONFIG_DEBUG_FILE */
+@@ -636,7 +610,7 @@ void wpa_msg_register_ifname_cb(wpa_msg_
+ }
+
+
+-void wpa_msg(void *ctx, int level, const char *fmt, ...)
++void _wpa_msg(void *ctx, int level, const char *fmt, ...)
+ {
+ va_list ap;
+ char *buf;
+@@ -674,7 +648,7 @@ void wpa_msg(void *ctx, int level, const
+ }
+
+
+-void wpa_msg_ctrl(void *ctx, int level, const char *fmt, ...)
++void _wpa_msg_ctrl(void *ctx, int level, const char *fmt, ...)
+ {
+ va_list ap;
+ char *buf;
+--- a/src/utils/wpa_debug.h
++++ b/src/utils/wpa_debug.h
+@@ -50,6 +50,17 @@ int wpa_debug_reopen_file(void);
+ void wpa_debug_close_file(void);
+ void wpa_debug_setup_stdout(void);
+
++/* internal */
++void _wpa_hexdump(int level, const char *title, const u8 *buf,
++ size_t len, int show, int only_syslog);
++void _wpa_hexdump_ascii(int level, const char *title, const void *buf,
++ size_t len, int show);
++extern int wpa_debug_show_keys;
++
++#ifndef CONFIG_MSG_MIN_PRIORITY
++#define CONFIG_MSG_MIN_PRIORITY 0
++#endif
++
+ /**
+ * wpa_debug_printf_timestamp - Print timestamp for debug output
+ *
+@@ -70,9 +81,15 @@ void wpa_debug_print_timestamp(void);
+ *
+ * Note: New line '\n' is added to the end of the text when printing to stdout.
+ */
+-void wpa_printf(int level, const char *fmt, ...)
++void _wpa_printf(int level, const char *fmt, ...)
+ PRINTF_FORMAT(2, 3);
+
++#define wpa_printf(level, ...) \
++ do { \
++ if (level >= CONFIG_MSG_MIN_PRIORITY) \
++ _wpa_printf(level, __VA_ARGS__); \
++ } while(0)
++
+ /**
+ * wpa_hexdump - conditional hex dump
+ * @level: priority level (MSG_*) of the message
+@@ -84,7 +101,13 @@ PRINTF_FORMAT(2, 3);
+ * output may be directed to stdout, stderr, and/or syslog based on
+ * configuration. The contents of buf is printed out has hex dump.
+ */
+-void wpa_hexdump(int level, const char *title, const void *buf, size_t len);
++static inline void wpa_hexdump(int level, const char *title, const void *buf, size_t len)
++{
++ if (level < CONFIG_MSG_MIN_PRIORITY)
++ return;
++
++ _wpa_hexdump(level, title, buf, len, 1, 1);
++}
+
+ static inline void wpa_hexdump_buf(int level, const char *title,
+ const struct wpabuf *buf)
+@@ -106,7 +129,13 @@ static inline void wpa_hexdump_buf(int l
+ * like wpa_hexdump(), but by default, does not include secret keys (passwords,
+ * etc.) in debug output.
+ */
+-void wpa_hexdump_key(int level, const char *title, const void *buf, size_t len);
++static inline void wpa_hexdump_key(int level, const char *title, const u8 *buf, size_t len)
++{
++ if (level < CONFIG_MSG_MIN_PRIORITY)
++ return;
++
++ _wpa_hexdump(level, title, buf, len, wpa_debug_show_keys, 1);
++}
+
+ static inline void wpa_hexdump_buf_key(int level, const char *title,
+ const struct wpabuf *buf)
+@@ -128,8 +157,14 @@ static inline void wpa_hexdump_buf_key(i
+ * the hex numbers and ASCII characters (for printable range) are shown. 16
+ * bytes per line will be shown.
+ */
+-void wpa_hexdump_ascii(int level, const char *title, const void *buf,
+- size_t len);
++static inline void wpa_hexdump_ascii(int level, const char *title,
++ const u8 *buf, size_t len)
++{
++ if (level < CONFIG_MSG_MIN_PRIORITY)
++ return;
++
++ _wpa_hexdump_ascii(level, title, buf, len, 1);
++}
+
+ /**
+ * wpa_hexdump_ascii_key - conditional hex dump, hide keys
+@@ -145,8 +180,14 @@ void wpa_hexdump_ascii(int level, const
+ * bytes per line will be shown. This works like wpa_hexdump_ascii(), but by
+ * default, does not include secret keys (passwords, etc.) in debug output.
+ */
+-void wpa_hexdump_ascii_key(int level, const char *title, const void *buf,
+- size_t len);
++static inline void wpa_hexdump_ascii_key(int level, const char *title,
++ const u8 *buf, size_t len)
++{
++ if (level < CONFIG_MSG_MIN_PRIORITY)
++ return;
++
++ _wpa_hexdump_ascii(level, title, buf, len, wpa_debug_show_keys);
++}
+
+ /*
+ * wpa_dbg() behaves like wpa_msg(), but it can be removed from build to reduce
+@@ -183,7 +224,12 @@ void wpa_hexdump_ascii_key(int level, co
+ *
+ * Note: New line '\n' is added to the end of the text when printing to stdout.
+ */
+-void wpa_msg(void *ctx, int level, const char *fmt, ...) PRINTF_FORMAT(3, 4);
++void _wpa_msg(void *ctx, int level, const char *fmt, ...) PRINTF_FORMAT(3, 4);
++#define wpa_msg(ctx, level, ...) \
++ do { \
++ if (level >= CONFIG_MSG_MIN_PRIORITY) \
++ _wpa_msg(ctx, level, __VA_ARGS__); \
++ } while(0)
+
+ /**
+ * wpa_msg_ctrl - Conditional printf for ctrl_iface monitors
+@@ -197,8 +243,13 @@ void wpa_msg(void *ctx, int level, const
+ * attached ctrl_iface monitors. In other words, it can be used for frequent
+ * events that do not need to be sent to syslog.
+ */
+-void wpa_msg_ctrl(void *ctx, int level, const char *fmt, ...)
++void _wpa_msg_ctrl(void *ctx, int level, const char *fmt, ...)
+ PRINTF_FORMAT(3, 4);
++#define wpa_msg_ctrl(ctx, level, ...) \
++ do { \
++ if (level >= CONFIG_MSG_MIN_PRIORITY) \
++ _wpa_msg_ctrl(ctx, level, __VA_ARGS__); \
++ } while(0)
+
+ /**
+ * wpa_msg_global - Global printf for ctrl_iface monitors
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/420-indicate-features.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/420-indicate-features.patch
new file mode 100644
index 0000000..12edb6b
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/420-indicate-features.patch
@@ -0,0 +1,63 @@
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -31,7 +31,7 @@
+ #include "config_file.h"
+ #include "eap_register.h"
+ #include "ctrl_iface.h"
+-
++#include "build_features.h"
+
+ struct hapd_global {
+ void **drv_priv;
+@@ -692,7 +692,7 @@ int main(int argc, char *argv[])
+ wpa_supplicant_event = hostapd_wpa_event;
+ wpa_supplicant_event_global = hostapd_wpa_event_global;
+ for (;;) {
+- c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:q");
++ c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:g:G:qv::");
+ if (c < 0)
+ break;
+ switch (c) {
+@@ -729,6 +729,8 @@ int main(int argc, char *argv[])
+ break;
+ #endif /* CONFIG_DEBUG_LINUX_TRACING */
+ case 'v':
++ if (optarg)
++ exit(!has_feature(optarg));
+ show_version();
+ exit(1);
+ case 'g':
+--- a/wpa_supplicant/main.c
++++ b/wpa_supplicant/main.c
+@@ -12,6 +12,7 @@
+ #endif /* __linux__ */
+
+ #include "common.h"
++#include "build_features.h"
+ #include "crypto/crypto.h"
+ #include "fst/fst.h"
+ #include "wpa_supplicant_i.h"
+@@ -203,7 +204,7 @@ int main(int argc, char *argv[])
+
+ for (;;) {
+ c = getopt(argc, argv,
+- "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuvW");
++ "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuv::W");
+ if (c < 0)
+ break;
+ switch (c) {
+@@ -306,8 +307,12 @@ int main(int argc, char *argv[])
+ break;
+ #endif /* CONFIG_CTRL_IFACE_DBUS_NEW */
+ case 'v':
+- printf("%s\n", wpa_supplicant_version);
+- exitcode = 0;
++ if (optarg) {
++ exitcode = !has_feature(optarg);
++ } else {
++ printf("%s\n", wpa_supplicant_version);
++ exitcode = 0;
++ }
+ goto out;
+ case 'W':
+ params.wait_for_monitor++;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/430-hostapd_cli_ifdef.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/430-hostapd_cli_ifdef.patch
new file mode 100644
index 0000000..e524209
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/430-hostapd_cli_ifdef.patch
@@ -0,0 +1,56 @@
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -388,7 +388,6 @@ static int hostapd_cli_cmd_disassociate(
+ }
+
+
+-#ifdef CONFIG_TAXONOMY
+ static int hostapd_cli_cmd_signature(struct wpa_ctrl *ctrl, int argc,
+ char *argv[])
+ {
+@@ -401,7 +400,6 @@ static int hostapd_cli_cmd_signature(str
+ os_snprintf(buf, sizeof(buf), "SIGNATURE %s", argv[0]);
+ return wpa_ctrl_command(ctrl, buf);
+ }
+-#endif /* CONFIG_TAXONOMY */
+
+
+ static int hostapd_cli_cmd_sa_query(struct wpa_ctrl *ctrl, int argc,
+@@ -418,7 +416,6 @@ static int hostapd_cli_cmd_sa_query(stru
+ }
+
+
+-#ifdef CONFIG_WPS
+ static int hostapd_cli_cmd_wps_pin(struct wpa_ctrl *ctrl, int argc,
+ char *argv[])
+ {
+@@ -644,7 +641,6 @@ static int hostapd_cli_cmd_wps_config(st
+ ssid_hex, argv[1]);
+ return wpa_ctrl_command(ctrl, buf);
+ }
+-#endif /* CONFIG_WPS */
+
+
+ static int hostapd_cli_cmd_disassoc_imminent(struct wpa_ctrl *ctrl, int argc,
+@@ -1588,13 +1584,10 @@ static const struct hostapd_cli_cmd host
+ { "disassociate", hostapd_cli_cmd_disassociate,
+ hostapd_complete_stations,
+ "<addr> = disassociate a station" },
+-#ifdef CONFIG_TAXONOMY
+ { "signature", hostapd_cli_cmd_signature, hostapd_complete_stations,
+ "<addr> = get taxonomy signature for a station" },
+-#endif /* CONFIG_TAXONOMY */
+ { "sa_query", hostapd_cli_cmd_sa_query, hostapd_complete_stations,
+ "<addr> = send SA Query to a station" },
+-#ifdef CONFIG_WPS
+ { "wps_pin", hostapd_cli_cmd_wps_pin, NULL,
+ "<uuid> <pin> [timeout] [addr] = add WPS Enrollee PIN" },
+ { "wps_check_pin", hostapd_cli_cmd_wps_check_pin, NULL,
+@@ -1619,7 +1612,6 @@ static const struct hostapd_cli_cmd host
+ "<SSID> <auth> <encr> <key> = configure AP" },
+ { "wps_get_status", hostapd_cli_cmd_wps_get_status, NULL,
+ "= show current WPS status" },
+-#endif /* CONFIG_WPS */
+ { "disassoc_imminent", hostapd_cli_cmd_disassoc_imminent, NULL,
+ "= send Disassociation Imminent notification" },
+ { "ess_disassoc", hostapd_cli_cmd_ess_disassoc, NULL,
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/431-wpa_cli_ifdef.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/431-wpa_cli_ifdef.patch
new file mode 100644
index 0000000..65c31c5
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/431-wpa_cli_ifdef.patch
@@ -0,0 +1,18 @@
+--- a/wpa_supplicant/wpa_cli.c
++++ b/wpa_supplicant/wpa_cli.c
+@@ -26,6 +26,15 @@
+ #include <cutils/properties.h>
+ #endif /* ANDROID */
+
++#ifndef CONFIG_P2P
++#define CONFIG_P2P
++#endif
++#ifndef CONFIG_AP
++#define CONFIG_AP
++#endif
++#ifndef CONFIG_MESH
++#define CONFIG_MESH
++#endif
+
+ static const char *const wpa_cli_version =
+ "wpa_cli v" VERSION_STR "\n"
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/432-missing-typedef.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/432-missing-typedef.patch
new file mode 100644
index 0000000..7a100f1
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/432-missing-typedef.patch
@@ -0,0 +1,10 @@
+--- a/src/drivers/linux_wext.h
++++ b/src/drivers/linux_wext.h
+@@ -26,6 +26,7 @@ typedef int32_t __s32;
+ typedef uint16_t __u16;
+ typedef int16_t __s16;
+ typedef uint8_t __u8;
++typedef int8_t __s8;
+ #ifndef __user
+ #define __user
+ #endif /* __user */
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/450-scan_wait.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/450-scan_wait.patch
new file mode 100644
index 0000000..ac874ad
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/450-scan_wait.patch
@@ -0,0 +1,73 @@
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -39,6 +39,8 @@ struct hapd_global {
+ };
+
+ static struct hapd_global global;
++static int daemonize = 0;
++static char *pid_file = NULL;
+
+
+ #ifndef CONFIG_NO_HOSTAPD_LOGGER
+@@ -146,6 +148,14 @@ static void hostapd_logger_cb(void *ctx,
+ }
+ #endif /* CONFIG_NO_HOSTAPD_LOGGER */
+
++static void hostapd_setup_complete_cb(void *ctx)
++{
++ if (daemonize && os_daemonize(pid_file)) {
++ perror("daemon");
++ return;
++ }
++ daemonize = 0;
++}
+
+ /**
+ * hostapd_driver_init - Preparate driver interface
+@@ -164,6 +174,8 @@ static int hostapd_driver_init(struct ho
+ return -1;
+ }
+
++ hapd->setup_complete_cb = hostapd_setup_complete_cb;
++
+ /* Initialize the driver interface */
+ if (!(b[0] | b[1] | b[2] | b[3] | b[4] | b[5]))
+ b = NULL;
+@@ -404,8 +416,6 @@ static void hostapd_global_deinit(const
+ #endif /* CONFIG_NATIVE_WINDOWS */
+
+ eap_server_unregister_methods();
+-
+- os_daemonize_terminate(pid_file);
+ }
+
+
+@@ -431,18 +441,6 @@ static int hostapd_global_run(struct hap
+ }
+ #endif /* EAP_SERVER_TNC */
+
+- if (daemonize) {
+- if (os_daemonize(pid_file)) {
+- wpa_printf(MSG_ERROR, "daemon: %s", strerror(errno));
+- return -1;
+- }
+- if (eloop_sock_requeue()) {
+- wpa_printf(MSG_ERROR, "eloop_sock_requeue: %s",
+- strerror(errno));
+- return -1;
+- }
+- }
+-
+ eloop_run();
+
+ return 0;
+@@ -645,8 +643,7 @@ int main(int argc, char *argv[])
+ struct hapd_interfaces interfaces;
+ int ret = 1;
+ size_t i, j;
+- int c, debug = 0, daemonize = 0;
+- char *pid_file = NULL;
++ int c, debug = 0;
+ const char *log_file = NULL;
+ const char *entropy_file = NULL;
+ char **bss_config = NULL, **tmp_bss;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
new file mode 100644
index 0000000..38ff663
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
@@ -0,0 +1,189 @@
+From 4bb69d15477e0f2b00e166845341dc933de47c58 Mon Sep 17 00:00:00 2001
+From: Antonio Quartulli <ordex@autistici.org>
+Date: Sun, 3 Jun 2012 18:22:56 +0200
+Subject: [PATCHv2 601/602] wpa_supplicant: add new config params to be used
+ with the ibss join command
+
+Signed-hostap: Antonio Quartulli <ordex@autistici.org>
+---
+ src/drivers/driver.h | 6 +++
+ wpa_supplicant/config.c | 96 +++++++++++++++++++++++++++++++++++++++
+ wpa_supplicant/config_ssid.h | 6 +++
+ wpa_supplicant/wpa_supplicant.c | 23 +++++++---
+ 4 files changed, 124 insertions(+), 7 deletions(-)
+
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -19,6 +19,7 @@
+
+ #define WPA_SUPPLICANT_DRIVER_VERSION 4
+
++#include "ap/sta_info.h"
+ #include "common/defs.h"
+ #include "common/ieee802_11_defs.h"
+ #include "common/wpa_common.h"
+@@ -894,6 +895,9 @@ struct wpa_driver_associate_params {
+ * responsible for selecting with which BSS to associate. */
+ const u8 *bssid;
+
++ unsigned char rates[WLAN_SUPP_RATES_MAX];
++ int mcast_rate;
++
+ /**
+ * bssid_hint - BSSID of a proposed AP
+ *
+--- a/wpa_supplicant/config.c
++++ b/wpa_supplicant/config.c
+@@ -18,6 +18,7 @@
+ #include "eap_peer/eap.h"
+ #include "p2p/p2p.h"
+ #include "fst/fst.h"
++#include "ap/sta_info.h"
+ #include "config.h"
+
+
+@@ -2345,6 +2346,97 @@ static char * wpa_config_write_peerkey(c
+ #endif /* NO_CONFIG_WRITE */
+
+
++static int wpa_config_parse_mcast_rate(const struct parse_data *data,
++ struct wpa_ssid *ssid, int line,
++ const char *value)
++{
++ ssid->mcast_rate = (int)(strtod(value, NULL) * 10);
++
++ return 0;
++}
++
++#ifndef NO_CONFIG_WRITE
++static char * wpa_config_write_mcast_rate(const struct parse_data *data,
++ struct wpa_ssid *ssid)
++{
++ char *value;
++ int res;
++
++ if (!ssid->mcast_rate == 0)
++ return NULL;
++
++ value = os_malloc(6); /* longest: 300.0 */
++ if (value == NULL)
++ return NULL;
++ res = os_snprintf(value, 5, "%.1f", (double)ssid->mcast_rate / 10);
++ if (res < 0) {
++ os_free(value);
++ return NULL;
++ }
++ return value;
++}
++#endif /* NO_CONFIG_WRITE */
++
++static int wpa_config_parse_rates(const struct parse_data *data,
++ struct wpa_ssid *ssid, int line,
++ const char *value)
++{
++ int i;
++ char *pos, *r, *sptr, *end;
++ double rate;
++
++ pos = (char *)value;
++ r = strtok_r(pos, ",", &sptr);
++ i = 0;
++ while (pos && i < WLAN_SUPP_RATES_MAX) {
++ rate = 0.0;
++ if (r)
++ rate = strtod(r, &end);
++ ssid->rates[i] = rate * 2;
++ if (*end != '\0' || rate * 2 != ssid->rates[i])
++ return 1;
++
++ i++;
++ r = strtok_r(NULL, ",", &sptr);
++ }
++
++ return 0;
++}
++
++#ifndef NO_CONFIG_WRITE
++static char * wpa_config_write_rates(const struct parse_data *data,
++ struct wpa_ssid *ssid)
++{
++ char *value, *pos;
++ int res, i;
++
++ if (ssid->rates[0] <= 0)
++ return NULL;
++
++ value = os_malloc(6 * WLAN_SUPP_RATES_MAX + 1);
++ if (value == NULL)
++ return NULL;
++ pos = value;
++ for (i = 0; i < WLAN_SUPP_RATES_MAX - 1; i++) {
++ res = os_snprintf(pos, 6, "%.1f,", (double)ssid->rates[i] / 2);
++ if (res < 0) {
++ os_free(value);
++ return NULL;
++ }
++ pos += res;
++ }
++ res = os_snprintf(pos, 6, "%.1f",
++ (double)ssid->rates[WLAN_SUPP_RATES_MAX - 1] / 2);
++ if (res < 0) {
++ os_free(value);
++ return NULL;
++ }
++
++ value[6 * WLAN_SUPP_RATES_MAX] = '\0';
++ return value;
++}
++#endif /* NO_CONFIG_WRITE */
++
+ /* Helper macros for network block parser */
+
+ #ifdef OFFSET
+@@ -2629,6 +2721,8 @@ static const struct parse_data ssid_fiel
+ { INT(ap_max_inactivity) },
+ { INT(dtim_period) },
+ { INT(beacon_int) },
++ { FUNC(rates) },
++ { FUNC(mcast_rate) },
+ #ifdef CONFIG_MACSEC
+ { INT_RANGE(macsec_policy, 0, 1) },
+ { INT_RANGE(macsec_integ_only, 0, 1) },
+--- a/wpa_supplicant/config_ssid.h
++++ b/wpa_supplicant/config_ssid.h
+@@ -10,8 +10,10 @@
+ #define CONFIG_SSID_H
+
+ #include "common/defs.h"
++#include "ap/sta_info.h"
+ #include "utils/list.h"
+ #include "eap_peer/eap_config.h"
++#include "drivers/nl80211_copy.h"
+
+
+ #define DEFAULT_EAP_WORKAROUND ((unsigned int) -1)
+@@ -846,6 +848,9 @@ struct wpa_ssid {
+ */
+ void *parent_cred;
+
++ unsigned char rates[WLAN_SUPP_RATES_MAX];
++ double mcast_rate;
++
+ #ifdef CONFIG_MACSEC
+ /**
+ * macsec_policy - Determines the policy for MACsec secure session
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -3899,6 +3899,12 @@ static void wpas_start_assoc_cb(struct w
+ params.beacon_int = ssid->beacon_int;
+ else
+ params.beacon_int = wpa_s->conf->beacon_int;
++ int i = 0;
++ while (i < WLAN_SUPP_RATES_MAX) {
++ params.rates[i] = ssid->rates[i];
++ i++;
++ }
++ params.mcast_rate = ssid->mcast_rate;
+ }
+
+ if (bss && ssid->enable_edmg)
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/461-driver_nl80211-use-new-parameters-during-ibss-join.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/461-driver_nl80211-use-new-parameters-during-ibss-join.patch
new file mode 100644
index 0000000..65d67b8
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/461-driver_nl80211-use-new-parameters-during-ibss-join.patch
@@ -0,0 +1,59 @@
+From ffc4445958a3ed4064f2e1bf73fa478a61c5cf7b Mon Sep 17 00:00:00 2001
+From: Antonio Quartulli <ordex@autistici.org>
+Date: Sun, 3 Jun 2012 18:42:25 +0200
+Subject: [PATCHv2 602/602] driver_nl80211: use new parameters during ibss join
+
+Signed-hostap: Antonio Quartulli <ordex@autistici.org>
+---
+ src/drivers/driver_nl80211.c | 33 ++++++++++++++++++++++++++++++++-
+ 1 file changed, 32 insertions(+), 1 deletion(-)
+
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -6005,7 +6005,7 @@ static int wpa_driver_nl80211_ibss(struc
+ struct wpa_driver_associate_params *params)
+ {
+ struct nl_msg *msg;
+- int ret = -1;
++ int ret = -1, i;
+ int count = 0;
+
+ wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
+@@ -6032,6 +6032,37 @@ retry:
+ nl80211_put_beacon_int(msg, params->beacon_int))
+ goto fail;
+
++ if (params->fixed_freq) {
++ wpa_printf(MSG_DEBUG, " * fixed_freq");
++ nla_put_flag(msg, NL80211_ATTR_FREQ_FIXED);
++ }
++
++ if (params->beacon_int > 0) {
++ wpa_printf(MSG_DEBUG, " * beacon_int=%d",
++ params->beacon_int);
++ nla_put_u32(msg, NL80211_ATTR_BEACON_INTERVAL,
++ params->beacon_int);
++ }
++
++ if (params->rates[0] > 0) {
++ wpa_printf(MSG_DEBUG, " * basic_rates:");
++ i = 0;
++ while (i < NL80211_MAX_SUPP_RATES &&
++ params->rates[i] > 0) {
++ wpa_printf(MSG_DEBUG, " %.1f",
++ (double)params->rates[i] / 2);
++ i++;
++ }
++ nla_put(msg, NL80211_ATTR_BSS_BASIC_RATES, i,
++ params->rates);
++ }
++
++ if (params->mcast_rate > 0) {
++ wpa_printf(MSG_DEBUG, " * mcast_rate=%.1f",
++ (double)params->mcast_rate / 10);
++ nla_put_u32(msg, NL80211_ATTR_MCAST_RATE, params->mcast_rate);
++ }
++
+ ret = nl80211_set_conn_keys(params, msg);
+ if (ret)
+ goto fail;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/463-add-mcast_rate-to-11s.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/463-add-mcast_rate-to-11s.patch
new file mode 100644
index 0000000..5dc19fe
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/463-add-mcast_rate-to-11s.patch
@@ -0,0 +1,68 @@
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Date: Thu, 11 May 2017 08:21:45 +0200
+Subject: [PATCH] set mcast_rate in mesh mode
+
+The wpa_supplicant code for IBSS allows to set the mcast rate. It is
+recommended to increase this value from 1 or 6 Mbit/s to something higher
+when using a mesh protocol on top which uses the multicast packet loss as
+indicator for the link quality.
+
+This setting was unfortunately not applied for mesh mode. But it would be
+beneficial when wpa_supplicant would behave similar to IBSS mode and set
+this argument during mesh join like authsae already does. At least it is
+helpful for companies/projects which are currently switching to 802.11s
+(without mesh_fwding and with mesh_ttl set to 1) as replacement for IBSS
+because newer drivers seem to support 802.11s but not IBSS anymore.
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Tested-by: Simon Wunderlich <simon.wunderlich@openmesh.com>
+
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1661,6 +1661,7 @@ struct wpa_driver_mesh_join_params {
+ #define WPA_DRIVER_MESH_FLAG_AMPE 0x00000008
+ unsigned int flags;
+ bool handle_dfs;
++ int mcast_rate;
+ };
+
+ struct wpa_driver_set_key_params {
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -10627,6 +10627,18 @@ static int nl80211_put_mesh_id(struct nl
+ }
+
+
++static int nl80211_put_mcast_rate(struct nl_msg *msg, int mcast_rate)
++{
++ if (mcast_rate > 0) {
++ wpa_printf(MSG_DEBUG, " * mcast_rate=%.1f",
++ (double)mcast_rate / 10);
++ return nla_put_u32(msg, NL80211_ATTR_MCAST_RATE, mcast_rate);
++ }
++
++ return 0;
++}
++
++
+ static int nl80211_put_mesh_config(struct nl_msg *msg,
+ struct wpa_driver_mesh_bss_params *params)
+ {
+@@ -10688,6 +10700,7 @@ static int nl80211_join_mesh(struct i802
+ nl80211_put_basic_rates(msg, params->basic_rates) ||
+ nl80211_put_mesh_id(msg, params->meshid, params->meshid_len) ||
+ nl80211_put_beacon_int(msg, params->beacon_int) ||
++ nl80211_put_mcast_rate(msg, params->mcast_rate) ||
+ nl80211_put_dtim_period(msg, params->dtim_period))
+ goto fail;
+
+--- a/wpa_supplicant/mesh.c
++++ b/wpa_supplicant/mesh.c
+@@ -632,6 +632,7 @@ int wpa_supplicant_join_mesh(struct wpa_
+
+ params->meshid = ssid->ssid;
+ params->meshid_len = ssid->ssid_len;
++ params->mcast_rate = ssid->mcast_rate;
+ ibss_mesh_setup_freq(wpa_s, ssid, ¶ms->freq);
+ wpa_s->mesh_ht_enabled = !!params->freq.ht_enabled;
+ wpa_s->mesh_vht_enabled = !!params->freq.vht_enabled;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/464-fix-mesh-obss-check.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/464-fix-mesh-obss-check.patch
new file mode 100644
index 0000000..48086ea
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/464-fix-mesh-obss-check.patch
@@ -0,0 +1,19 @@
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -2539,11 +2539,13 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ for (j = 0; j < wpa_s->last_scan_res_used; j++) {
+ struct wpa_bss *bss = wpa_s->last_scan_res[j];
+
+- if (ssid->mode != WPAS_MODE_IBSS)
++ /* Don't adjust control freq in case of fixed_freq */
++ if (ssid->fixed_freq) {
++ obss_scan = 0;
+ break;
++ }
+
+- /* Don't adjust control freq in case of fixed_freq */
+- if (ssid->fixed_freq)
++ if (ssid->mode != WPAS_MODE_IBSS)
+ break;
+
+ if (!bss_is_ibss(bss))
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/465-hostapd-config-support-random-BSS-color.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/465-hostapd-config-support-random-BSS-color.patch
new file mode 100644
index 0000000..6810b79
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/465-hostapd-config-support-random-BSS-color.patch
@@ -0,0 +1,24 @@
+From c9304d3303d563ad6d2619f4e07864ed12f96889 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 14 May 2022 21:41:03 +0200
+Subject: [PATCH] hostapd: config: support random BSS color
+
+Configure the HE BSS color to a random value in case the config defines
+a BSS color which exceeds the max BSS color (63).
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ hostapd/config_file.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3489,6 +3489,8 @@ static int hostapd_config_fill(struct ho
+ } else if (os_strcmp(buf, "he_bss_color") == 0) {
+ conf->he_op.he_bss_color = atoi(pos) & 0x3f;
+ conf->he_op.he_bss_color_disabled = 0;
++ if (atoi(pos) > 63)
++ conf->he_op.he_bss_color = os_random() % 63 + 1;
+ } else if (os_strcmp(buf, "he_bss_color_partial") == 0) {
+ conf->he_op.he_bss_color_partial = atoi(pos);
+ } else if (os_strcmp(buf, "he_default_pe_duration") == 0) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/470-survey_data_fallback.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/470-survey_data_fallback.patch
new file mode 100644
index 0000000..359b5f3
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/470-survey_data_fallback.patch
@@ -0,0 +1,25 @@
+--- a/src/ap/acs.c
++++ b/src/ap/acs.c
+@@ -420,20 +420,19 @@ static int acs_usable_bw160_chan(const s
+ static int acs_survey_is_sufficient(struct freq_survey *survey)
+ {
+ if (!(survey->filled & SURVEY_HAS_NF)) {
++ survey->nf = -95;
+ wpa_printf(MSG_INFO, "ACS: Survey is missing noise floor");
+- return 0;
+ }
+
+ if (!(survey->filled & SURVEY_HAS_CHAN_TIME)) {
++ survey->channel_time = 0;
+ wpa_printf(MSG_INFO, "ACS: Survey is missing channel time");
+- return 0;
+ }
+
+ if (!(survey->filled & SURVEY_HAS_CHAN_TIME_BUSY) &&
+ !(survey->filled & SURVEY_HAS_CHAN_TIME_RX)) {
+ wpa_printf(MSG_INFO,
+ "ACS: Survey is missing RX and busy time (at least one is required)");
+- return 0;
+ }
+
+ return 1;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/500-lto-jobserver-support.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/500-lto-jobserver-support.patch
new file mode 100644
index 0000000..e0458b2
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/500-lto-jobserver-support.patch
@@ -0,0 +1,59 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -1307,7 +1307,7 @@ hostapd_multi.a: $(BCHECK) $(OBJS)
+ @$(AR) cr $@ hostapd_multi.o $(OBJS)
+
+ hostapd: $(OBJS)
+- $(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
++ +$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
+ @$(E) " LD " $@
+
+ ifdef CONFIG_WPA_TRACE
+@@ -1318,7 +1318,7 @@ _OBJS_VAR := OBJS_c
+ include ../src/objs.mk
+
+ hostapd_cli: $(OBJS_c)
+- $(Q)$(CC) $(LDFLAGS) -o hostapd_cli $(OBJS_c) $(LIBS_c)
++ +$(Q)$(CC) $(LDFLAGS) -o hostapd_cli $(OBJS_c) $(LIBS_c)
+ @$(E) " LD " $@
+
+ NOBJS = nt_password_hash.o ../src/crypto/ms_funcs.o $(SHA1OBJS)
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -1949,31 +1949,31 @@ wpa_supplicant_multi.a: .config $(BCHECK
+ @$(AR) cr $@ wpa_supplicant_multi.o $(OBJS)
+
+ wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
+- $(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
++ +$(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
+ @$(E) " LD " $@
+
+ _OBJS_VAR := OBJS_t
+ include ../src/objs.mk
+ eapol_test: $(OBJS_t)
+- $(Q)$(LDO) $(LDFLAGS) -o eapol_test $(OBJS_t) $(LIBS)
++ +$(Q)$(LDO) $(LDFLAGS) -o eapol_test $(OBJS_t) $(LIBS)
+ @$(E) " LD " $@
+
+ _OBJS_VAR := OBJS_t2
+ include ../src/objs.mk
+ preauth_test: $(OBJS_t2)
+- $(Q)$(LDO) $(LDFLAGS) -o preauth_test $(OBJS_t2) $(LIBS)
++ +$(Q)$(LDO) $(LDFLAGS) -o preauth_test $(OBJS_t2) $(LIBS)
+ @$(E) " LD " $@
+
+ _OBJS_VAR := OBJS_p
+ include ../src/objs.mk
+ wpa_passphrase: $(OBJS_p)
+- $(Q)$(LDO) $(LDFLAGS) -o wpa_passphrase $(OBJS_p) $(LIBS_p) $(LIBS)
++ +$(Q)$(LDO) $(LDFLAGS) -o wpa_passphrase $(OBJS_p) $(LIBS_p) $(LIBS)
+ @$(E) " LD " $@
+
+ _OBJS_VAR := OBJS_c
+ include ../src/objs.mk
+ wpa_cli: $(OBJS_c)
+- $(Q)$(LDO) $(LDFLAGS) -o wpa_cli $(OBJS_c) $(LIBS_c)
++ +$(Q)$(LDO) $(LDFLAGS) -o wpa_cli $(OBJS_c) $(LIBS_c)
+ @$(E) " LD " $@
+
+ LIBCTRL += ../src/common/wpa_ctrl.o
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/590-rrm-wnm-statistics.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/590-rrm-wnm-statistics.patch
new file mode 100644
index 0000000..98b8820
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/590-rrm-wnm-statistics.patch
@@ -0,0 +1,92 @@
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -162,6 +162,21 @@ struct hostapd_sae_commit_queue {
+ };
+
+ /**
++ * struct hostapd_openwrt_stats - OpenWrt custom STA/AP statistics
++ */
++struct hostapd_openwrt_stats {
++ struct {
++ u64 neighbor_report_tx;
++ } rrm;
++
++ struct {
++ u64 bss_transition_query_rx;
++ u64 bss_transition_request_tx;
++ u64 bss_transition_response_rx;
++ } wnm;
++};
++
++/**
+ * struct hostapd_data - hostapd per-BSS data structure
+ */
+ struct hostapd_data {
+@@ -175,6 +190,9 @@ struct hostapd_data {
+
+ u8 own_addr[ETH_ALEN];
+
++ /* OpenWrt specific statistics */
++ struct hostapd_openwrt_stats openwrt_stats;
++
+ int num_sta; /* number of entries in sta_list */
+ struct sta_info *sta_list; /* STA info list head */
+ #define STA_HASH_SIZE 256
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -386,6 +386,7 @@ static int ieee802_11_send_bss_trans_mgm
+ mgmt->u.action.u.bss_tm_req.validity_interval = 1;
+ pos = mgmt->u.action.u.bss_tm_req.variable;
+
++ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
+ MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
+ "validity_interval=%u",
+@@ -659,10 +660,12 @@ int ieee802_11_rx_wnm_action_ap(struct h
+
+ switch (action) {
+ case WNM_BSS_TRANS_MGMT_QUERY:
++ hapd->openwrt_stats.wnm.bss_transition_query_rx++;
+ ieee802_11_rx_bss_trans_mgmt_query(hapd, mgmt->sa, payload,
+ plen);
+ return 0;
+ case WNM_BSS_TRANS_MGMT_RESP:
++ hapd->openwrt_stats.wnm.bss_transition_response_rx++;
+ ieee802_11_rx_bss_trans_mgmt_resp(hapd, mgmt->sa, payload,
+ plen);
+ return 0;
+@@ -709,6 +712,7 @@ int wnm_send_disassoc_imminent(struct ho
+
+ pos = mgmt->u.action.u.bss_tm_req.variable;
+
++ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request frame to indicate imminent disassociation (disassoc_timer=%d) to "
+ MACSTR, disassoc_timer, MAC2STR(sta->addr));
+ if (hostapd_drv_send_mlme(hapd, buf, pos - buf, 0, NULL, 0, 0) < 0) {
+@@ -790,6 +794,7 @@ int wnm_send_ess_disassoc_imminent(struc
+ return -1;
+ }
+
++ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ if (disassoc_timer) {
+ /* send disassociation frame after time-out */
+ set_disassoc_timer(hapd, sta, disassoc_timer);
+@@ -870,6 +875,7 @@ int wnm_send_bss_tm_req(struct hostapd_d
+ }
+ os_free(buf);
+
++ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ if (disassoc_timer) {
+ /* send disassociation frame after time-out */
+ set_disassoc_timer(hapd, sta, disassoc_timer);
+--- a/src/ap/rrm.c
++++ b/src/ap/rrm.c
+@@ -269,6 +269,8 @@ static void hostapd_send_nei_report_resp
+ }
+ }
+
++ hapd->openwrt_stats.rrm.neighbor_report_tx++;
++
+ hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr,
+ wpabuf_head(buf), wpabuf_len(buf));
+ wpabuf_free(buf);
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/599-wpa_supplicant-fix-warnings.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/599-wpa_supplicant-fix-warnings.patch
new file mode 100644
index 0000000..e70dc61
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/599-wpa_supplicant-fix-warnings.patch
@@ -0,0 +1,19 @@
+--- a/wpa_supplicant/wps_supplicant.h
++++ b/wpa_supplicant/wps_supplicant.h
+@@ -9,6 +9,7 @@
+ #ifndef WPS_SUPPLICANT_H
+ #define WPS_SUPPLICANT_H
+
++struct wpa_bss;
+ struct wpa_scan_results;
+
+ #ifdef CONFIG_WPS
+@@ -16,8 +17,6 @@ struct wpa_scan_results;
+ #include "wps/wps.h"
+ #include "wps/wps_defs.h"
+
+-struct wpa_bss;
+-
+ struct wps_new_ap_settings {
+ const char *ssid_hex;
+ const char *auth;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/600-ubus_support.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/600-ubus_support.patch
new file mode 100644
index 0000000..521e7df
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/600-ubus_support.patch
@@ -0,0 +1,619 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -166,6 +166,11 @@ OBJS += ../src/common/hw_features_common
+
+ OBJS += ../src/eapol_auth/eapol_auth_sm.o
+
++ifdef CONFIG_UBUS
++CFLAGS += -DUBUS_SUPPORT
++OBJS += ../src/ap/ubus.o
++LIBS += -lubox -lubus
++endif
+
+ ifdef CONFIG_CODE_COVERAGE
+ CFLAGS += -O0 -fprofile-arcs -ftest-coverage
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -18,6 +18,7 @@
+ #include "utils/list.h"
+ #include "ap_config.h"
+ #include "drivers/driver.h"
++#include "ubus.h"
+
+ #define OCE_STA_CFON_ENABLED(hapd) \
+ ((hapd->conf->oce & OCE_STA_CFON) && \
+@@ -92,7 +93,7 @@ struct hapd_interfaces {
+ #ifdef CONFIG_CTRL_IFACE_UDP
+ unsigned char ctrl_iface_cookie[CTRL_IFACE_COOKIE_LEN];
+ #endif /* CONFIG_CTRL_IFACE_UDP */
+-
++ struct ubus_object ubus;
+ };
+
+ enum hostapd_chan_status {
+@@ -183,6 +184,7 @@ struct hostapd_data {
+ struct hostapd_iface *iface;
+ struct hostapd_config *iconf;
+ struct hostapd_bss_config *conf;
++ struct hostapd_ubus_bss ubus;
+ int interface_added; /* virtual interface added for this BSS */
+ unsigned int started:1;
+ unsigned int disabled:1;
+@@ -673,6 +675,7 @@ hostapd_alloc_bss_data(struct hostapd_if
+ struct hostapd_bss_config *bss);
+ int hostapd_setup_interface(struct hostapd_iface *iface);
+ int hostapd_setup_interface_complete(struct hostapd_iface *iface, int err);
++void hostapd_set_own_neighbor_report(struct hostapd_data *hapd);
+ void hostapd_interface_deinit(struct hostapd_iface *iface);
+ void hostapd_interface_free(struct hostapd_iface *iface);
+ struct hostapd_iface * hostapd_alloc_iface(void);
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -401,6 +401,7 @@ void hostapd_free_hapd_data(struct hosta
+ hapd->beacon_set_done = 0;
+
+ wpa_printf(MSG_DEBUG, "%s(%s)", __func__, hapd->conf->iface);
++ hostapd_ubus_free_bss(hapd);
+ accounting_deinit(hapd);
+ hostapd_deinit_wpa(hapd);
+ vlan_deinit(hapd);
+@@ -1431,6 +1432,8 @@ static int hostapd_setup_bss(struct host
+ if (hapd->driver && hapd->driver->set_operstate)
+ hapd->driver->set_operstate(hapd->drv_priv, 1);
+
++ hostapd_ubus_add_bss(hapd);
++
+ return 0;
+ }
+
+@@ -2050,6 +2053,7 @@ static int hostapd_setup_interface_compl
+ if (err)
+ goto fail;
+
++ hostapd_ubus_add_iface(iface);
+ wpa_printf(MSG_DEBUG, "Completing interface initialization");
+ if (iface->freq) {
+ #ifdef NEED_AP_MLME
+@@ -2248,6 +2252,7 @@ dfs_offload:
+
+ fail:
+ wpa_printf(MSG_ERROR, "Interface initialization failed");
++ hostapd_ubus_free_iface(iface);
+ hostapd_set_state(iface, HAPD_IFACE_DISABLED);
+ wpa_msg(hapd->msg_ctx, MSG_INFO, AP_EVENT_DISABLED);
+ #ifdef CONFIG_FST
+@@ -2723,6 +2728,7 @@ void hostapd_interface_deinit_free(struc
+ (unsigned int) iface->conf->num_bss);
+ driver = iface->bss[0]->driver;
+ drv_priv = iface->bss[0]->drv_priv;
++ hostapd_ubus_free_iface(iface);
+ hostapd_interface_deinit(iface);
+ wpa_printf(MSG_DEBUG, "%s: driver=%p drv_priv=%p -> hapd_deinit",
+ __func__, driver, drv_priv);
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -3573,13 +3573,18 @@ static void handle_auth(struct hostapd_d
+ u16 auth_alg, auth_transaction, status_code;
+ u16 resp = WLAN_STATUS_SUCCESS;
+ struct sta_info *sta = NULL;
+- int res, reply_res;
++ int res, reply_res, ubus_resp;
+ u16 fc;
+ const u8 *challenge = NULL;
+ u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
+ size_t resp_ies_len = 0;
+ u16 seq_ctrl;
+ struct radius_sta rad_info;
++ struct hostapd_ubus_request req = {
++ .type = HOSTAPD_UBUS_AUTH_REQ,
++ .mgmt_frame = mgmt,
++ .ssi_signal = rssi,
++ };
+
+ if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
+ wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
+@@ -3747,6 +3752,13 @@ static void handle_auth(struct hostapd_d
+ resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ goto fail;
+ }
++ ubus_resp = hostapd_ubus_handle_event(hapd, &req);
++ if (ubus_resp) {
++ wpa_printf(MSG_DEBUG, "Station " MACSTR " rejected by ubus handler.\n",
++ MAC2STR(mgmt->sa));
++ resp = ubus_resp > 0 ? (u16) ubus_resp : WLAN_STATUS_UNSPECIFIED_FAILURE;
++ goto fail;
++ }
+ if (res == HOSTAPD_ACL_PENDING)
+ return;
+
+@@ -5488,7 +5500,7 @@ static void handle_assoc(struct hostapd_
+ int resp = WLAN_STATUS_SUCCESS;
+ u16 reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ const u8 *pos;
+- int left, i;
++ int left, i, ubus_resp;
+ struct sta_info *sta;
+ u8 *tmp = NULL;
+ #ifdef CONFIG_FILS
+@@ -5701,6 +5713,11 @@ static void handle_assoc(struct hostapd_
+ left = res;
+ }
+ #endif /* CONFIG_FILS */
++ struct hostapd_ubus_request req = {
++ .type = HOSTAPD_UBUS_ASSOC_REQ,
++ .mgmt_frame = mgmt,
++ .ssi_signal = rssi,
++ };
+
+ /* followed by SSID and Supported rates; and HT capabilities if 802.11n
+ * is used */
+@@ -5799,6 +5816,13 @@ static void handle_assoc(struct hostapd_
+ }
+ #endif /* CONFIG_FILS */
+
++ ubus_resp = hostapd_ubus_handle_event(hapd, &req);
++ if (ubus_resp) {
++ wpa_printf(MSG_DEBUG, "Station " MACSTR " assoc rejected by ubus handler.\n",
++ MAC2STR(mgmt->sa));
++ resp = ubus_resp > 0 ? (u16) ubus_resp : WLAN_STATUS_UNSPECIFIED_FAILURE;
++ goto fail;
++ }
+ fail:
+
+ /*
+@@ -5892,6 +5916,7 @@ static void handle_disassoc(struct hosta
+ wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
+ MAC2STR(mgmt->sa),
+ le_to_host16(mgmt->u.disassoc.reason_code));
++ hostapd_ubus_notify(hapd, "disassoc", mgmt->sa);
+
+ sta = ap_get_sta(hapd, mgmt->sa);
+ if (sta == NULL) {
+@@ -5961,6 +5986,8 @@ static void handle_deauth(struct hostapd
+ /* Clear the PTKSA cache entries for PASN */
+ ptksa_cache_flush(hapd->ptksa, mgmt->sa, WPA_CIPHER_NONE);
+
++ hostapd_ubus_notify(hapd, "deauth", mgmt->sa);
++
+ sta = ap_get_sta(hapd, mgmt->sa);
+ if (sta == NULL) {
+ wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -919,6 +919,12 @@ void handle_probe_req(struct hostapd_dat
+ u16 csa_offs[2];
+ size_t csa_offs_len;
+ struct radius_sta rad_info;
++ struct hostapd_ubus_request req = {
++ .type = HOSTAPD_UBUS_PROBE_REQ,
++ .mgmt_frame = mgmt,
++ .ssi_signal = ssi_signal,
++ .elems = &elems,
++ };
+
+ if (hapd->iconf->rssi_ignore_probe_request && ssi_signal &&
+ ssi_signal < hapd->iconf->rssi_ignore_probe_request)
+@@ -1105,6 +1111,12 @@ void handle_probe_req(struct hostapd_dat
+ }
+ #endif /* CONFIG_P2P */
+
++ if (hostapd_ubus_handle_event(hapd, &req)) {
++ wpa_printf(MSG_DEBUG, "Probe request for " MACSTR " rejected by ubus handler.\n",
++ MAC2STR(mgmt->sa));
++ return;
++ }
++
+ /* TODO: verify that supp_rates contains at least one matching rate
+ * with AP configuration */
+
+--- a/src/ap/drv_callbacks.c
++++ b/src/ap/drv_callbacks.c
+@@ -145,6 +145,10 @@ int hostapd_notif_assoc(struct hostapd_d
+ u16 reason = WLAN_REASON_UNSPECIFIED;
+ int status = WLAN_STATUS_SUCCESS;
+ const u8 *p2p_dev_addr = NULL;
++ struct hostapd_ubus_request req = {
++ .type = HOSTAPD_UBUS_ASSOC_REQ,
++ .addr = addr,
++ };
+
+ if (addr == NULL) {
+ /*
+@@ -237,6 +241,12 @@ int hostapd_notif_assoc(struct hostapd_d
+ goto fail;
+ }
+
++ if (hostapd_ubus_handle_event(hapd, &req)) {
++ wpa_printf(MSG_DEBUG, "Station " MACSTR " assoc rejected by ubus handler.\n",
++ MAC2STR(req.addr));
++ goto fail;
++ }
++
+ #ifdef CONFIG_P2P
+ if (elems.p2p) {
+ wpabuf_free(sta->p2p_ie);
+--- a/src/ap/sta_info.c
++++ b/src/ap/sta_info.c
+@@ -460,6 +460,7 @@ void ap_handle_timer(void *eloop_ctx, vo
+ hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
+ HOSTAPD_LEVEL_INFO, "deauthenticated due to "
+ "local deauth request");
++ hostapd_ubus_notify(hapd, "local-deauth", sta->addr);
+ ap_free_sta(hapd, sta);
+ return;
+ }
+@@ -615,6 +616,7 @@ skip_poll:
+ mlme_deauthenticate_indication(
+ hapd, sta,
+ WLAN_REASON_PREV_AUTH_NOT_VALID);
++ hostapd_ubus_notify(hapd, "inactive-deauth", sta->addr);
+ ap_free_sta(hapd, sta);
+ break;
+ }
+@@ -1298,12 +1300,25 @@ void ap_sta_set_authorized(struct hostap
+ sta->addr, authorized, dev_addr);
+
+ if (authorized) {
++ static const char * const auth_algs[] = {
++ [WLAN_AUTH_OPEN] = "open",
++ [WLAN_AUTH_SHARED_KEY] = "shared",
++ [WLAN_AUTH_FT] = "ft",
++ [WLAN_AUTH_SAE] = "sae",
++ [WLAN_AUTH_FILS_SK] = "fils-sk",
++ [WLAN_AUTH_FILS_SK_PFS] = "fils-sk-pfs",
++ [WLAN_AUTH_FILS_PK] = "fils-pk",
++ [WLAN_AUTH_PASN] = "pasn",
++ };
++ const char *auth_alg = NULL;
+ const char *keyid;
+ char keyid_buf[100];
+ char ip_addr[100];
++ char alg_buf[100];
+
+ keyid_buf[0] = '\0';
+ ip_addr[0] = '\0';
++ alg_buf[0] = '\0';
+ #ifdef CONFIG_P2P
+ if (wpa_auth_get_ip_addr(sta->wpa_sm, ip_addr_buf) == 0) {
+ os_snprintf(ip_addr, sizeof(ip_addr),
+@@ -1313,22 +1328,31 @@ void ap_sta_set_authorized(struct hostap
+ }
+ #endif /* CONFIG_P2P */
+
++ if (sta->auth_alg < ARRAY_SIZE(auth_algs))
++ auth_alg = auth_algs[sta->auth_alg];
++
++ if (auth_alg)
++ os_snprintf(alg_buf, sizeof(alg_buf),
++ " auth_alg=%s", auth_alg);
++
+ keyid = ap_sta_wpa_get_keyid(hapd, sta);
+ if (keyid) {
+ os_snprintf(keyid_buf, sizeof(keyid_buf),
+ " keyid=%s", keyid);
+ }
+
+- wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s%s",
+- buf, ip_addr, keyid_buf);
++ hostapd_ubus_notify_authorized(hapd, sta, auth_alg);
++ wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s%s%s",
++ buf, ip_addr, keyid_buf, alg_buf);
+
+ if (hapd->msg_ctx_parent &&
+ hapd->msg_ctx_parent != hapd->msg_ctx)
+ wpa_msg_no_global(hapd->msg_ctx_parent, MSG_INFO,
+- AP_STA_CONNECTED "%s%s%s",
+- buf, ip_addr, keyid_buf);
++ AP_STA_CONNECTED "%s%s%s%s",
++ buf, ip_addr, keyid_buf, alg_buf);
+ } else {
+ wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED "%s", buf);
++ hostapd_ubus_notify(hapd, "disassoc", sta->addr);
+
+ if (hapd->msg_ctx_parent &&
+ hapd->msg_ctx_parent != hapd->msg_ctx)
+--- a/src/ap/wpa_auth_glue.c
++++ b/src/ap/wpa_auth_glue.c
+@@ -268,6 +268,7 @@ static void hostapd_wpa_auth_psk_failure
+ struct hostapd_data *hapd = ctx;
+ wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POSSIBLE_PSK_MISMATCH MACSTR,
+ MAC2STR(addr));
++ hostapd_ubus_notify(hapd, "key-mismatch", addr);
+ }
+
+
+--- a/wpa_supplicant/Makefile
++++ b/wpa_supplicant/Makefile
+@@ -183,6 +183,12 @@ ifdef CONFIG_EAPOL_TEST
+ CFLAGS += -Werror -DEAPOL_TEST
+ endif
+
++ifdef CONFIG_UBUS
++CFLAGS += -DUBUS_SUPPORT
++OBJS += ubus.o
++LIBS += -lubox -lubus
++endif
++
+ ifdef CONFIG_CODE_COVERAGE
+ CFLAGS += -O0 -fprofile-arcs -ftest-coverage
+ LIBS += -lgcov
+@@ -977,6 +983,9 @@ ifdef CONFIG_CTRL_IFACE_MIB
+ CFLAGS += -DCONFIG_CTRL_IFACE_MIB
+ endif
+ OBJS += ../src/ap/ctrl_iface_ap.o
++ifdef CONFIG_UBUS
++OBJS += ../src/ap/ubus.o
++endif
+ endif
+
+ CFLAGS += -DEAP_SERVER -DEAP_SERVER_IDENTITY
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -7285,6 +7285,8 @@ struct wpa_supplicant * wpa_supplicant_a
+ }
+ #endif /* CONFIG_P2P */
+
++ wpas_ubus_add_bss(wpa_s);
++
+ return wpa_s;
+ }
+
+@@ -7311,6 +7313,8 @@ int wpa_supplicant_remove_iface(struct w
+ struct wpa_supplicant *parent = wpa_s->parent;
+ #endif /* CONFIG_MESH */
+
++ wpas_ubus_free_bss(wpa_s);
++
+ /* Remove interface from the global list of interfaces */
+ prev = global->ifaces;
+ if (prev == wpa_s) {
+@@ -7614,8 +7618,12 @@ int wpa_supplicant_run(struct wpa_global
+ eloop_register_signal_terminate(wpa_supplicant_terminate, global);
+ eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
+
++ wpas_ubus_add(global);
++
+ eloop_run();
+
++ wpas_ubus_free(global);
++
+ return 0;
+ }
+
+--- a/wpa_supplicant/wpa_supplicant_i.h
++++ b/wpa_supplicant/wpa_supplicant_i.h
+@@ -20,6 +20,7 @@
+ #include "wps/wps_defs.h"
+ #include "config_ssid.h"
+ #include "wmm_ac.h"
++#include "ubus.h"
+
+ extern const char *const wpa_supplicant_version;
+ extern const char *const wpa_supplicant_license;
+@@ -323,6 +324,8 @@ struct wpa_global {
+ #endif /* CONFIG_WIFI_DISPLAY */
+
+ struct psk_list_entry *add_psk; /* From group formation */
++
++ struct ubus_object ubus_global;
+ };
+
+
+@@ -707,6 +710,7 @@ struct wpa_supplicant {
+ unsigned char own_addr[ETH_ALEN];
+ unsigned char perm_addr[ETH_ALEN];
+ char ifname[100];
++ struct wpas_ubus_bss ubus;
+ #ifdef CONFIG_MATCH_IFACE
+ int matched;
+ #endif /* CONFIG_MATCH_IFACE */
+--- a/wpa_supplicant/wps_supplicant.c
++++ b/wpa_supplicant/wps_supplicant.c
+@@ -33,6 +33,7 @@
+ #include "p2p/p2p.h"
+ #include "p2p_supplicant.h"
+ #include "wps_supplicant.h"
++#include "ubus.h"
+
+
+ #ifndef WPS_PIN_SCAN_IGNORE_SEL_REG
+@@ -391,6 +392,8 @@ static int wpa_supplicant_wps_cred(void
+ wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
+ cred->cred_attr, cred->cred_attr_len);
+
++ wpas_ubus_notify(wpa_s, cred);
++
+ if (wpa_s->conf->wps_cred_processing == 1)
+ return 0;
+
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -897,6 +897,7 @@ int main(int argc, char *argv[])
+ }
+
+ hostapd_global_ctrl_iface_init(&interfaces);
++ hostapd_ubus_add(&interfaces);
+
+ if (hostapd_global_run(&interfaces, daemonize, pid_file)) {
+ wpa_printf(MSG_ERROR, "Failed to start eloop");
+@@ -906,6 +907,7 @@ int main(int argc, char *argv[])
+ ret = 0;
+
+ out:
++ hostapd_ubus_free(&interfaces);
+ hostapd_global_ctrl_iface_deinit(&interfaces);
+ /* Deinitialize all interfaces */
+ for (i = 0; i < interfaces.count; i++) {
+--- a/wpa_supplicant/main.c
++++ b/wpa_supplicant/main.c
+@@ -204,7 +204,7 @@ int main(int argc, char *argv[])
+
+ for (;;) {
+ c = getopt(argc, argv,
+- "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuv::W");
++ "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:nNo:O:p:P:qsTtuv::W");
+ if (c < 0)
+ break;
+ switch (c) {
+@@ -272,6 +272,9 @@ int main(int argc, char *argv[])
+ params.conf_p2p_dev = optarg;
+ break;
+ #endif /* CONFIG_P2P */
++ case 'n':
++ iface_count = 0;
++ break;
+ case 'o':
+ params.override_driver = optarg;
+ break;
+--- a/src/ap/rrm.c
++++ b/src/ap/rrm.c
+@@ -89,6 +89,9 @@ static void hostapd_handle_beacon_report
+ return;
+ wpa_msg(hapd->msg_ctx, MSG_INFO, BEACON_RESP_RX MACSTR " %u %02x %s",
+ MAC2STR(addr), token, rep_mode, report);
++ if (len < sizeof(struct rrm_measurement_beacon_report))
++ return;
++ hostapd_ubus_notify_beacon_report(hapd, addr, token, rep_mode, (struct rrm_measurement_beacon_report*) pos, len);
+ }
+
+
+@@ -352,6 +355,9 @@ void hostapd_handle_radio_measurement(st
+ mgmt->u.action.u.rrm.action, MAC2STR(mgmt->sa));
+
+ switch (mgmt->u.action.u.rrm.action) {
++ case WLAN_RRM_LINK_MEASUREMENT_REPORT:
++ hostapd_ubus_handle_link_measurement(hapd, buf, len);
++ break;
+ case WLAN_RRM_RADIO_MEASUREMENT_REPORT:
+ hostapd_handle_radio_msmt_report(hapd, buf, len);
+ break;
+--- a/src/ap/vlan_init.c
++++ b/src/ap/vlan_init.c
+@@ -22,6 +22,7 @@
+ static int vlan_if_add(struct hostapd_data *hapd, struct hostapd_vlan *vlan,
+ int existsok)
+ {
++ bool vlan_exists = iface_exists(vlan->ifname);
+ int ret;
+ #ifdef CONFIG_WEP
+ int i;
+@@ -36,7 +37,7 @@ static int vlan_if_add(struct hostapd_da
+ }
+ #endif /* CONFIG_WEP */
+
+- if (!iface_exists(vlan->ifname))
++ if (!vlan_exists)
+ ret = hostapd_vlan_if_add(hapd, vlan->ifname);
+ else if (!existsok)
+ return -1;
+@@ -51,6 +52,9 @@ static int vlan_if_add(struct hostapd_da
+ if (hapd->wpa_auth)
+ ret = wpa_auth_ensure_group(hapd->wpa_auth, vlan->vlan_id);
+
++ if (!ret && !vlan_exists)
++ hostapd_ubus_add_vlan(hapd, vlan);
++
+ if (ret == 0)
+ return ret;
+
+@@ -77,6 +81,8 @@ int vlan_if_remove(struct hostapd_data *
+ "WPA deinitialization for VLAN %d failed (%d)",
+ vlan->vlan_id, ret);
+
++ hostapd_ubus_remove_vlan(hapd, vlan);
++
+ return hostapd_vlan_if_remove(hapd, vlan->ifname);
+ }
+
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1203,6 +1203,8 @@ int hostapd_dfs_pre_cac_expired(struct h
+ "freq=%d ht_enabled=%d chan_offset=%d chan_width=%d cf1=%d cf2=%d",
+ freq, ht_enabled, chan_offset, chan_width, cf1, cf2);
+
++ hostapd_ubus_notify_radar_detected(iface, freq, chan_width, cf1, cf2);
++
+ /* Proceed only if DFS is not offloaded to the driver */
+ if (iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD)
+ return 0;
+--- a/src/ap/airtime_policy.c
++++ b/src/ap/airtime_policy.c
+@@ -112,8 +112,14 @@ static void set_sta_weights(struct hosta
+ {
+ struct sta_info *sta;
+
+- for (sta = hapd->sta_list; sta; sta = sta->next)
+- sta_set_airtime_weight(hapd, sta, weight);
++ for (sta = hapd->sta_list; sta; sta = sta->next) {
++ unsigned int sta_weight = weight;
++
++ if (sta->dyn_airtime_weight)
++ sta_weight = (weight * sta->dyn_airtime_weight) / 256;
++
++ sta_set_airtime_weight(hapd, sta, sta_weight);
++ }
+ }
+
+
+@@ -244,7 +250,10 @@ int airtime_policy_new_sta(struct hostap
+ unsigned int weight;
+
+ if (hapd->iconf->airtime_mode == AIRTIME_MODE_STATIC) {
+- weight = get_weight_for_sta(hapd, sta->addr);
++ if (sta->dyn_airtime_weight)
++ weight = sta->dyn_airtime_weight;
++ else
++ weight = get_weight_for_sta(hapd, sta->addr);
+ if (weight)
+ return sta_set_airtime_weight(hapd, sta, weight);
+ }
+--- a/src/ap/sta_info.h
++++ b/src/ap/sta_info.h
+@@ -328,6 +328,7 @@ struct sta_info {
+ #endif /* CONFIG_TESTING_OPTIONS */
+ #ifdef CONFIG_AIRTIME_POLICY
+ unsigned int airtime_weight;
++ unsigned int dyn_airtime_weight;
+ struct os_reltime backlogged_until;
+ #endif /* CONFIG_AIRTIME_POLICY */
+
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -455,7 +455,8 @@ static void ieee802_11_rx_bss_trans_mgmt
+ MAC2STR(addr), reason, hex ? " neighbor=" : "", hex);
+ os_free(hex);
+
+- ieee802_11_send_bss_trans_mgmt_request(hapd, addr, dialog_token);
++ if (!hostapd_ubus_notify_bss_transition_query(hapd, addr, dialog_token, reason, pos, end - pos))
++ ieee802_11_send_bss_trans_mgmt_request(hapd, addr, dialog_token);
+ }
+
+
+@@ -477,7 +478,7 @@ static void ieee802_11_rx_bss_trans_mgmt
+ size_t len)
+ {
+ u8 dialog_token, status_code, bss_termination_delay;
+- const u8 *pos, *end;
++ const u8 *pos, *end, *target_bssid = NULL;
+ int enabled = hapd->conf->bss_transition;
+ struct sta_info *sta;
+
+@@ -524,6 +525,7 @@ static void ieee802_11_rx_bss_trans_mgmt
+ wpa_printf(MSG_DEBUG, "WNM: not enough room for Target BSSID field");
+ return;
+ }
++ target_bssid = pos;
+ sta->agreed_to_steer = 1;
+ eloop_cancel_timeout(ap_sta_reset_steer_flag_timer, hapd, sta);
+ eloop_register_timeout(2, 0, ap_sta_reset_steer_flag_timer,
+@@ -543,6 +545,10 @@ static void ieee802_11_rx_bss_trans_mgmt
+ MAC2STR(addr), status_code, bss_termination_delay);
+ }
+
++ hostapd_ubus_notify_bss_transition_response(hapd, sta->addr, dialog_token,
++ status_code, bss_termination_delay,
++ target_bssid, pos, end - pos);
++
+ wpa_hexdump(MSG_DEBUG, "WNM: BSS Transition Candidate List Entries",
+ pos, end - pos);
+ }
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/610-hostapd_cli_ujail_permission.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/610-hostapd_cli_ujail_permission.patch
new file mode 100644
index 0000000..a03fcc9
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/610-hostapd_cli_ujail_permission.patch
@@ -0,0 +1,33 @@
+--- a/src/common/wpa_ctrl.c
++++ b/src/common/wpa_ctrl.c
+@@ -135,7 +135,7 @@ try_again:
+ return NULL;
+ }
+ tries++;
+-#ifdef ANDROID
++
+ /* Set client socket file permissions so that bind() creates the client
+ * socket with these permissions and there is no need to try to change
+ * them with chmod() after bind() which would have potential issues with
+@@ -147,7 +147,7 @@ try_again:
+ * operations to allow the response to go through. Those are using the
+ * no-deference-symlinks version to avoid races. */
+ fchmod(ctrl->s, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+-#endif /* ANDROID */
++
+ if (bind(ctrl->s, (struct sockaddr *) &ctrl->local,
+ sizeof(ctrl->local)) < 0) {
+ if (errno == EADDRINUSE && tries < 2) {
+@@ -165,7 +165,11 @@ try_again:
+ return NULL;
+ }
+
+-#ifdef ANDROID
++#ifndef ANDROID
++ /* Set group even if we do not have privileges to change owner */
++ lchown(ctrl->local.sun_path, -1, 101);
++ lchown(ctrl->local.sun_path, 101, 101);
++#else
+ /* Set group even if we do not have privileges to change owner */
+ lchown(ctrl->local.sun_path, -1, AID_WIFI);
+ lchown(ctrl->local.sun_path, AID_SYSTEM, AID_WIFI);
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/700-wifi-reload.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/700-wifi-reload.patch
new file mode 100644
index 0000000..174127d
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/700-wifi-reload.patch
@@ -0,0 +1,220 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2416,6 +2416,8 @@ static int hostapd_config_fill(struct ho
+ bss->isolate = atoi(pos);
+ } else if (os_strcmp(buf, "ap_max_inactivity") == 0) {
+ bss->ap_max_inactivity = atoi(pos);
++ } else if (os_strcmp(buf, "config_id") == 0) {
++ bss->config_id = os_strdup(pos);
+ } else if (os_strcmp(buf, "skip_inactivity_poll") == 0) {
+ bss->skip_inactivity_poll = atoi(pos);
+ } else if (os_strcmp(buf, "country_code") == 0) {
+@@ -3121,6 +3123,8 @@ static int hostapd_config_fill(struct ho
+ }
+ } else if (os_strcmp(buf, "acs_exclude_dfs") == 0) {
+ conf->acs_exclude_dfs = atoi(pos);
++ } else if (os_strcmp(buf, "radio_config_id") == 0) {
++ conf->config_id = os_strdup(pos);
+ } else if (os_strcmp(buf, "op_class") == 0) {
+ conf->op_class = atoi(pos);
+ } else if (os_strcmp(buf, "channel") == 0) {
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -796,6 +796,7 @@ void hostapd_config_free_bss(struct host
+ os_free(conf->radius_req_attr_sqlite);
+ os_free(conf->rsn_preauth_interfaces);
+ os_free(conf->ctrl_interface);
++ os_free(conf->config_id);
+ os_free(conf->ca_cert);
+ os_free(conf->server_cert);
+ os_free(conf->server_cert2);
+@@ -995,6 +996,7 @@ void hostapd_config_free(struct hostapd_
+
+ for (i = 0; i < conf->num_bss; i++)
+ hostapd_config_free_bss(conf->bss[i]);
++ os_free(conf->config_id);
+ os_free(conf->bss);
+ os_free(conf->supported_rates);
+ os_free(conf->basic_rates);
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -285,6 +285,8 @@ struct hostapd_bss_config {
+ char vlan_bridge[IFNAMSIZ + 1];
+ char wds_bridge[IFNAMSIZ + 1];
+
++ char *config_id;
++
+ enum hostapd_logger_level logger_syslog_level, logger_stdout_level;
+
+ unsigned int logger_syslog; /* module bitfield */
+@@ -969,6 +971,7 @@ struct eht_phy_capabilities_info {
+ struct hostapd_config {
+ struct hostapd_bss_config **bss, *last_bss;
+ size_t num_bss;
++ char *config_id;
+
+ u16 beacon_int;
+ int rts_threshold;
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -224,6 +224,10 @@ static int hostapd_iface_conf_changed(st
+ {
+ size_t i;
+
++ if (newconf->config_id != oldconf->config_id)
++ if (strcmp(newconf->config_id, oldconf->config_id))
++ return 1;
++
+ if (newconf->num_bss != oldconf->num_bss)
+ return 1;
+
+@@ -237,7 +241,7 @@ static int hostapd_iface_conf_changed(st
+ }
+
+
+-int hostapd_reload_config(struct hostapd_iface *iface)
++int hostapd_reload_config(struct hostapd_iface *iface, int reconf)
+ {
+ struct hapd_interfaces *interfaces = iface->interfaces;
+ struct hostapd_data *hapd = iface->bss[0];
+@@ -260,13 +264,16 @@ int hostapd_reload_config(struct hostapd
+ if (newconf == NULL)
+ return -1;
+
+- hostapd_clear_old(iface);
+-
+ oldconf = hapd->iconf;
+ if (hostapd_iface_conf_changed(newconf, oldconf)) {
+ char *fname;
+ int res;
+
++ if (reconf)
++ return -1;
++
++ hostapd_clear_old(iface);
++
+ wpa_printf(MSG_DEBUG,
+ "Configuration changes include interface/BSS modification - force full disable+enable sequence");
+ fname = os_strdup(iface->config_fname);
+@@ -291,6 +298,24 @@ int hostapd_reload_config(struct hostapd
+ wpa_printf(MSG_ERROR,
+ "Failed to enable interface on config reload");
+ return res;
++ } else {
++ for (j = 0; j < iface->num_bss; j++) {
++ hapd = iface->bss[j];
++ if (!hapd->config_id || strcmp(hapd->config_id, newconf->bss[j]->config_id)) {
++ hostapd_flush_old_stations(iface->bss[j],
++ WLAN_REASON_PREV_AUTH_NOT_VALID);
++#ifdef CONFIG_WEP
++ hostapd_broadcast_wep_clear(iface->bss[j]);
++#endif
++
++#ifndef CONFIG_NO_RADIUS
++ /* TODO: update dynamic data based on changed configuration
++ * items (e.g., open/close sockets, etc.) */
++ radius_client_flush(iface->bss[j]->radius, 0);
++#endif /* CONFIG_NO_RADIUS */
++ wpa_printf(MSG_INFO, "bss %zu changed", j);
++ }
++ }
+ }
+ iface->conf = newconf;
+
+@@ -307,6 +332,12 @@ int hostapd_reload_config(struct hostapd
+
+ for (j = 0; j < iface->num_bss; j++) {
+ hapd = iface->bss[j];
++ if (hapd->config_id) {
++ os_free(hapd->config_id);
++ hapd->config_id = NULL;
++ }
++ if (newconf->bss[j]->config_id)
++ hapd->config_id = strdup(newconf->bss[j]->config_id);
+ hapd->iconf = newconf;
+ hapd->conf = newconf->bss[j];
+ hostapd_reload_bss(hapd);
+@@ -2420,6 +2451,10 @@ hostapd_alloc_bss_data(struct hostapd_if
+ hapd->iconf = conf;
+ hapd->conf = bss;
+ hapd->iface = hapd_iface;
++ if (bss && bss->config_id)
++ hapd->config_id = strdup(bss->config_id);
++ else
++ hapd->config_id = NULL;
+ if (conf)
+ hapd->driver = conf->driver;
+ hapd->ctrl_sock = -1;
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -47,7 +47,7 @@ struct mesh_conf;
+ struct hostapd_iface;
+
+ struct hapd_interfaces {
+- int (*reload_config)(struct hostapd_iface *iface);
++ int (*reload_config)(struct hostapd_iface *iface, int reconf);
+ struct hostapd_config * (*config_read_cb)(const char *config_fname);
+ int (*ctrl_iface_init)(struct hostapd_data *hapd);
+ void (*ctrl_iface_deinit)(struct hostapd_data *hapd);
+@@ -185,6 +185,7 @@ struct hostapd_data {
+ struct hostapd_config *iconf;
+ struct hostapd_bss_config *conf;
+ struct hostapd_ubus_bss ubus;
++ char *config_id;
+ int interface_added; /* virtual interface added for this BSS */
+ unsigned int started:1;
+ unsigned int disabled:1;
+@@ -667,7 +668,7 @@ struct hostapd_iface {
+ int hostapd_for_each_interface(struct hapd_interfaces *interfaces,
+ int (*cb)(struct hostapd_iface *iface,
+ void *ctx), void *ctx);
+-int hostapd_reload_config(struct hostapd_iface *iface);
++int hostapd_reload_config(struct hostapd_iface *iface, int reconf);
+ void hostapd_reconfig_encryption(struct hostapd_data *hapd);
+ struct hostapd_data *
+ hostapd_alloc_bss_data(struct hostapd_iface *hapd_iface,
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -4852,6 +4852,9 @@ static int wpa_driver_nl80211_set_ap(voi
+ if (ret) {
+ wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
+ ret, strerror(-ret));
++ if (!bss->beacon_set)
++ ret = 0;
++ bss->beacon_set = 0;
+ } else {
+ bss->beacon_set = 1;
+ nl80211_set_bss(bss, params->cts_protect, params->preamble,
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -186,7 +186,7 @@ static int hostapd_ctrl_iface_update(str
+ iface->interfaces->config_read_cb = hostapd_ctrl_iface_config_read;
+ reload_opts = txt;
+
+- hostapd_reload_config(iface);
++ hostapd_reload_config(iface, 0);
+
+ iface->interfaces->config_read_cb = config_read_cb;
+ }
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -317,7 +317,7 @@ static void handle_term(int sig, void *s
+
+ static int handle_reload_iface(struct hostapd_iface *iface, void *ctx)
+ {
+- if (hostapd_reload_config(iface) < 0) {
++ if (hostapd_reload_config(iface, 0) < 0) {
+ wpa_printf(MSG_WARNING, "Failed to read new configuration "
+ "file - continuing with old.");
+ }
+--- a/src/ap/wps_hostapd.c
++++ b/src/ap/wps_hostapd.c
+@@ -315,7 +315,7 @@ static void wps_reload_config(void *eloo
+
+ wpa_printf(MSG_DEBUG, "WPS: Reload configuration data");
+ if (iface->interfaces == NULL ||
+- iface->interfaces->reload_config(iface) < 0) {
++ iface->interfaces->reload_config(iface, 1) < 0) {
+ wpa_printf(MSG_WARNING, "WPS: Failed to reload the updated "
+ "configuration");
+ }
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/710-vlan_no_bridge.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/710-vlan_no_bridge.patch
new file mode 100644
index 0000000..b06ef8f
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/710-vlan_no_bridge.patch
@@ -0,0 +1,41 @@
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -121,6 +121,7 @@ struct hostapd_ssid {
+ #define DYNAMIC_VLAN_OPTIONAL 1
+ #define DYNAMIC_VLAN_REQUIRED 2
+ int dynamic_vlan;
++ int vlan_no_bridge;
+ #define DYNAMIC_VLAN_NAMING_WITHOUT_DEVICE 0
+ #define DYNAMIC_VLAN_NAMING_WITH_DEVICE 1
+ #define DYNAMIC_VLAN_NAMING_END 2
+--- a/src/ap/vlan_full.c
++++ b/src/ap/vlan_full.c
+@@ -475,6 +475,9 @@ void vlan_newlink(const char *ifname, st
+ if (!vlan)
+ return;
+
++ if (hapd->conf->ssid.vlan_no_bridge)
++ goto out;
++
+ vlan->configured = 1;
+
+ notempty = vlan->vlan_desc.notempty;
+@@ -506,6 +509,7 @@ void vlan_newlink(const char *ifname, st
+ ifname, br_name, tagged[i], hapd);
+ }
+
++out:
+ ifconfig_up(ifname);
+ }
+
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3346,6 +3346,8 @@ static int hostapd_config_fill(struct ho
+ #ifndef CONFIG_NO_VLAN
+ } else if (os_strcmp(buf, "dynamic_vlan") == 0) {
+ bss->ssid.dynamic_vlan = atoi(pos);
++ } else if (os_strcmp(buf, "vlan_no_bridge") == 0) {
++ bss->ssid.vlan_no_bridge = atoi(pos);
+ } else if (os_strcmp(buf, "per_sta_vif") == 0) {
+ bss->ssid.per_sta_vif = atoi(pos);
+ } else if (os_strcmp(buf, "vlan_file") == 0) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/711-wds_bridge_force.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/711-wds_bridge_force.patch
new file mode 100644
index 0000000..169807c
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/711-wds_bridge_force.patch
@@ -0,0 +1,22 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2316,6 +2316,8 @@ static int hostapd_config_fill(struct ho
+ sizeof(conf->bss[0]->iface));
+ } else if (os_strcmp(buf, "bridge") == 0) {
+ os_strlcpy(bss->bridge, pos, sizeof(bss->bridge));
++ if (!bss->wds_bridge[0])
++ os_strlcpy(bss->wds_bridge, pos, sizeof(bss->wds_bridge));
+ } else if (os_strcmp(buf, "vlan_bridge") == 0) {
+ os_strlcpy(bss->vlan_bridge, pos, sizeof(bss->vlan_bridge));
+ } else if (os_strcmp(buf, "wds_bridge") == 0) {
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -340,8 +340,6 @@ int hostapd_set_wds_sta(struct hostapd_d
+ return -1;
+ if (hapd->conf->wds_bridge[0])
+ bridge = hapd->conf->wds_bridge;
+- else if (hapd->conf->bridge[0])
+- bridge = hapd->conf->bridge;
+ return hapd->driver->set_wds_sta(hapd->drv_priv, addr, aid, val,
+ bridge, ifname_wds);
+ }
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/720-iface_max_num_sta.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/720-iface_max_num_sta.patch
new file mode 100644
index 0000000..ed76d22
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/720-iface_max_num_sta.patch
@@ -0,0 +1,82 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2841,6 +2841,14 @@ static int hostapd_config_fill(struct ho
+ line, bss->max_num_sta, MAX_STA_COUNT);
+ return 1;
+ }
++ } else if (os_strcmp(buf, "iface_max_num_sta") == 0) {
++ conf->max_num_sta = atoi(pos);
++ if (conf->max_num_sta < 0 ||
++ conf->max_num_sta > MAX_STA_COUNT) {
++ wpa_printf(MSG_ERROR, "Line %d: Invalid max_num_sta=%d; allowed range 0..%d",
++ line, conf->max_num_sta, MAX_STA_COUNT);
++ return 1;
++ }
+ } else if (os_strcmp(buf, "wpa") == 0) {
+ bss->wpa = atoi(pos);
+ } else if (os_strcmp(buf, "extended_key_id") == 0) {
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -711,6 +711,7 @@ void hostapd_cleanup_cs_params(struct ho
+ void hostapd_periodic_iface(struct hostapd_iface *iface);
+ int hostapd_owe_trans_get_info(struct hostapd_data *hapd);
+ void hostapd_ocv_check_csa_sa_query(void *eloop_ctx, void *timeout_ctx);
++int hostapd_check_max_sta(struct hostapd_data *hapd);
+
+ void hostapd_switch_color(struct hostapd_data *hapd, u64 bitmap);
+ void hostapd_cleanup_cca_params(struct hostapd_data *hapd);
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -241,6 +241,30 @@ static int hostapd_iface_conf_changed(st
+ }
+
+
++static inline int hostapd_iface_num_sta(struct hostapd_iface *iface)
++{
++ int num_sta = 0;
++ int i;
++
++ for (i = 0; i < iface->num_bss; i++)
++ num_sta += iface->bss[i]->num_sta;
++
++ return num_sta;
++}
++
++
++int hostapd_check_max_sta(struct hostapd_data *hapd)
++{
++ if (hapd->num_sta >= hapd->conf->max_num_sta)
++ return 1;
++
++ if (hapd->iconf->max_num_sta &&
++ hostapd_iface_num_sta(hapd->iface) >= hapd->iconf->max_num_sta)
++ return 1;
++
++ return 0;
++}
++
+ int hostapd_reload_config(struct hostapd_iface *iface, int reconf)
+ {
+ struct hapd_interfaces *interfaces = iface->interfaces;
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1135,7 +1135,7 @@ void handle_probe_req(struct hostapd_dat
+ if (hapd->conf->no_probe_resp_if_max_sta &&
+ is_multicast_ether_addr(mgmt->da) &&
+ is_multicast_ether_addr(mgmt->bssid) &&
+- hapd->num_sta >= hapd->conf->max_num_sta &&
++ hostapd_check_max_sta(hapd) &&
+ !ap_get_sta(hapd, mgmt->sa)) {
+ wpa_printf(MSG_MSGDUMP, "%s: Ignore Probe Request from " MACSTR
+ " since no room for additional STA",
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1010,6 +1010,8 @@ struct hostapd_config {
+ unsigned int track_sta_max_num;
+ unsigned int track_sta_max_age;
+
++ int max_num_sta;
++
+ char country[3]; /* first two octets: country code as described in
+ * ISO/IEC 3166-1. Third octet:
+ * ' ' (ascii 32): all environments
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/730-ft_iface.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/730-ft_iface.patch
new file mode 100644
index 0000000..d9a4f15
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/730-ft_iface.patch
@@ -0,0 +1,38 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3000,6 +3000,8 @@ static int hostapd_config_fill(struct ho
+ wpa_printf(MSG_INFO,
+ "Line %d: Obsolete peerkey parameter ignored", line);
+ #ifdef CONFIG_IEEE80211R_AP
++ } else if (os_strcmp(buf, "ft_iface") == 0) {
++ os_strlcpy(bss->ft_iface, pos, sizeof(bss->ft_iface));
+ } else if (os_strcmp(buf, "mobility_domain") == 0) {
+ if (os_strlen(pos) != 2 * MOBILITY_DOMAIN_ID_LEN ||
+ hexstr2bin(pos, bss->mobility_domain,
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -283,6 +283,7 @@ struct airtime_sta_weight {
+ struct hostapd_bss_config {
+ char iface[IFNAMSIZ + 1];
+ char bridge[IFNAMSIZ + 1];
++ char ft_iface[IFNAMSIZ + 1];
+ char vlan_bridge[IFNAMSIZ + 1];
+ char wds_bridge[IFNAMSIZ + 1];
+
+--- a/src/ap/wpa_auth_glue.c
++++ b/src/ap/wpa_auth_glue.c
+@@ -1595,8 +1595,12 @@ int hostapd_setup_wpa(struct hostapd_dat
+ wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt)) {
+ const char *ft_iface;
+
+- ft_iface = hapd->conf->bridge[0] ? hapd->conf->bridge :
+- hapd->conf->iface;
++ if (hapd->conf->ft_iface[0])
++ ft_iface = hapd->conf->ft_iface;
++ else if (hapd->conf->bridge[0])
++ ft_iface = hapd->conf->bridge;
++ else
++ ft_iface = hapd->conf->iface;
+ hapd->l2 = l2_packet_init(ft_iface, NULL, ETH_P_RRB,
+ hostapd_rrb_receive, hapd, 1);
+ if (!hapd->l2) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/740-snoop_iface.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/740-snoop_iface.patch
new file mode 100644
index 0000000..608f15a
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/740-snoop_iface.patch
@@ -0,0 +1,66 @@
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -284,6 +284,7 @@ struct hostapd_bss_config {
+ char iface[IFNAMSIZ + 1];
+ char bridge[IFNAMSIZ + 1];
+ char ft_iface[IFNAMSIZ + 1];
++ char snoop_iface[IFNAMSIZ + 1];
+ char vlan_bridge[IFNAMSIZ + 1];
+ char wds_bridge[IFNAMSIZ + 1];
+
+--- a/src/ap/x_snoop.c
++++ b/src/ap/x_snoop.c
+@@ -33,14 +33,16 @@ int x_snoop_init(struct hostapd_data *ha
+
+ hapd->x_snoop_initialized = true;
+
+- if (hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_HAIRPIN_MODE,
++ if (!conf->snoop_iface[0] &&
++ hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_HAIRPIN_MODE,
+ 1)) {
+ wpa_printf(MSG_DEBUG,
+ "x_snoop: Failed to enable hairpin_mode on the bridge port");
+ return -1;
+ }
+
+- if (hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_PROXYARP, 1)) {
++ if (!conf->snoop_iface[0] &&
++ hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_PROXYARP, 1)) {
+ wpa_printf(MSG_DEBUG,
+ "x_snoop: Failed to enable proxyarp on the bridge port");
+ return -1;
+@@ -54,7 +56,8 @@ int x_snoop_init(struct hostapd_data *ha
+ }
+
+ #ifdef CONFIG_IPV6
+- if (hostapd_drv_br_set_net_param(hapd, DRV_BR_MULTICAST_SNOOPING, 1)) {
++ if (!conf->snoop_iface[0] &&
++ hostapd_drv_br_set_net_param(hapd, DRV_BR_MULTICAST_SNOOPING, 1)) {
+ wpa_printf(MSG_DEBUG,
+ "x_snoop: Failed to enable multicast snooping on the bridge");
+ return -1;
+@@ -73,8 +76,12 @@ x_snoop_get_l2_packet(struct hostapd_dat
+ {
+ struct hostapd_bss_config *conf = hapd->conf;
+ struct l2_packet_data *l2;
++ const char *ifname = conf->bridge;
+
+- l2 = l2_packet_init(conf->bridge, NULL, ETH_P_ALL, handler, hapd, 1);
++ if (conf->snoop_iface[0])
++ ifname = conf->snoop_iface;
++
++ l2 = l2_packet_init(ifname, NULL, ETH_P_ALL, handler, hapd, 1);
+ if (l2 == NULL) {
+ wpa_printf(MSG_DEBUG,
+ "x_snoop: Failed to initialize L2 packet processing %s",
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2318,6 +2318,8 @@ static int hostapd_config_fill(struct ho
+ os_strlcpy(bss->bridge, pos, sizeof(bss->bridge));
+ if (!bss->wds_bridge[0])
+ os_strlcpy(bss->wds_bridge, pos, sizeof(bss->wds_bridge));
++ } else if (os_strcmp(buf, "snoop_iface") == 0) {
++ os_strlcpy(bss->snoop_iface, pos, sizeof(bss->snoop_iface));
+ } else if (os_strcmp(buf, "vlan_bridge") == 0) {
+ os_strlcpy(bss->vlan_bridge, pos, sizeof(bss->vlan_bridge));
+ } else if (os_strcmp(buf, "wds_bridge") == 0) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/750-qos_map_set_without_interworking.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/750-qos_map_set_without_interworking.patch
new file mode 100644
index 0000000..479d561
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/750-qos_map_set_without_interworking.patch
@@ -0,0 +1,97 @@
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -1602,6 +1602,8 @@ static int parse_anqp_elem(struct hostap
+ return 0;
+ }
+
++#endif /* CONFIG_INTERWORKING */
++
+
+ static int parse_qos_map_set(struct hostapd_bss_config *bss,
+ char *buf, int line)
+@@ -1643,8 +1645,6 @@ static int parse_qos_map_set(struct host
+ return 0;
+ }
+
+-#endif /* CONFIG_INTERWORKING */
+-
+
+ #ifdef CONFIG_HS20
+ static int hs20_parse_conn_capab(struct hostapd_bss_config *bss, char *buf,
+@@ -4046,10 +4046,10 @@ static int hostapd_config_fill(struct ho
+ bss->gas_frag_limit = val;
+ } else if (os_strcmp(buf, "gas_comeback_delay") == 0) {
+ bss->gas_comeback_delay = atoi(pos);
++#endif /* CONFIG_INTERWORKING */
+ } else if (os_strcmp(buf, "qos_map_set") == 0) {
+ if (parse_qos_map_set(bss, pos, line) < 0)
+ return 1;
+-#endif /* CONFIG_INTERWORKING */
+ #ifdef CONFIG_RADIUS_TEST
+ } else if (os_strcmp(buf, "dump_msk_file") == 0) {
+ os_free(bss->dump_msk_file);
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -1424,6 +1424,7 @@ static int hostapd_setup_bss(struct host
+ wpa_printf(MSG_ERROR, "GAS server initialization failed");
+ return -1;
+ }
++#endif /* CONFIG_INTERWORKING */
+
+ if (conf->qos_map_set_len &&
+ hostapd_drv_set_qos_map(hapd, conf->qos_map_set,
+@@ -1431,7 +1432,6 @@ static int hostapd_setup_bss(struct host
+ wpa_printf(MSG_ERROR, "Failed to initialize QoS Map");
+ return -1;
+ }
+-#endif /* CONFIG_INTERWORKING */
+
+ if (conf->bss_load_update_period && bss_load_update_init(hapd)) {
+ wpa_printf(MSG_ERROR, "BSS Load initialization failed");
+--- a/wpa_supplicant/events.c
++++ b/wpa_supplicant/events.c
+@@ -2586,8 +2586,6 @@ void wnm_bss_keep_alive_deinit(struct wp
+ }
+
+
+-#ifdef CONFIG_INTERWORKING
+-
+ static int wpas_qos_map_set(struct wpa_supplicant *wpa_s, const u8 *qos_map,
+ size_t len)
+ {
+@@ -2620,8 +2618,6 @@ static void interworking_process_assoc_r
+ }
+ }
+
+-#endif /* CONFIG_INTERWORKING */
+-
+
+ static void multi_ap_process_assoc_resp(struct wpa_supplicant *wpa_s,
+ const u8 *ies, size_t ies_len)
+@@ -2954,10 +2950,8 @@ static int wpa_supplicant_event_associnf
+ wnm_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
+ data->assoc_info.resp_ies_len);
+ #endif /* CONFIG_WNM */
+-#ifdef CONFIG_INTERWORKING
+ interworking_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
+ data->assoc_info.resp_ies_len);
+-#endif /* CONFIG_INTERWORKING */
+ if (wpa_s->hw_capab == CAPAB_VHT &&
+ get_ie(data->assoc_info.resp_ies,
+ data->assoc_info.resp_ies_len, WLAN_EID_VHT_CAP))
+--- a/src/ap/ieee802_11_shared.c
++++ b/src/ap/ieee802_11_shared.c
+@@ -1100,13 +1100,11 @@ u8 * hostapd_eid_rsnxe(struct hostapd_da
+ u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
+ const u8 *ext_capab_ie, size_t ext_capab_ie_len)
+ {
+-#ifdef CONFIG_INTERWORKING
+ /* check for QoS Map support */
+ if (ext_capab_ie_len >= 5) {
+ if (ext_capab_ie[4] & 0x01)
+ sta->qos_map_enabled = 1;
+ }
+-#endif /* CONFIG_INTERWORKING */
+
+ if (ext_capab_ie_len > 0) {
+ sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/751-qos_map_ignore_when_unsupported.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/751-qos_map_ignore_when_unsupported.patch
new file mode 100644
index 0000000..d90a275
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/751-qos_map_ignore_when_unsupported.patch
@@ -0,0 +1,12 @@
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -864,7 +864,8 @@ int hostapd_start_dfs_cac(struct hostapd
+ int hostapd_drv_set_qos_map(struct hostapd_data *hapd,
+ const u8 *qos_map_set, u8 qos_map_set_len)
+ {
+- if (!hapd->driver || !hapd->driver->set_qos_map || !hapd->drv_priv)
++ if (!hapd->driver || !hapd->driver->set_qos_map || !hapd->drv_priv ||
++ !(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_QOS_MAPPING))
+ return 0;
+ return hapd->driver->set_qos_map(hapd->drv_priv, qos_map_set,
+ qos_map_set_len);
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch
new file mode 100644
index 0000000..1d9e956
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch
@@ -0,0 +1,58 @@
+From 37528a5205cb0b9e2238b7d97fb2ff5457448f1c Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Thu, 8 Sep 2022 01:45:41 +0200
+Subject: [PATCH] acs: don't select indoor channel on outdoor operation
+
+Don't select channels designated for exclusive-indoor use when the
+country3 element is set on outdoor operation.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ src/ap/acs.c | 9 +++++++++
+ src/ap/dfs.c | 3 +++
+ 2 files changed, 12 insertions(+)
+
+--- a/src/ap/acs.c
++++ b/src/ap/acs.c
+@@ -552,6 +552,9 @@ static void acs_survey_mode_interference
+ if (chan->max_tx_power < iface->conf->min_tx_power)
+ continue;
+
++ if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
++ continue;
++
+ wpa_printf(MSG_DEBUG, "ACS: Survey analysis for channel %d (%d MHz)",
+ chan->chan, chan->freq);
+
+@@ -686,6 +689,9 @@ acs_find_ideal_chan_mode(struct hostapd_
+ if (chan->max_tx_power < iface->conf->min_tx_power)
+ continue;
+
++ if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
++ continue;
++
+ if (!chan_bw_allowed(chan, bw, 1, 1)) {
+ wpa_printf(MSG_DEBUG,
+ "ACS: Channel %d: BW %u is not supported",
+@@ -1067,6 +1073,9 @@ static int * acs_request_scan_add_freqs(
+ if (chan->max_tx_power < iface->conf->min_tx_power)
+ continue;
+
++ if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
++ continue;
++
+ *freq++ = chan->freq;
+ }
+
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -282,6 +282,9 @@ static int dfs_find_channel(struct hosta
+ if (chan->max_tx_power < iface->conf->min_tx_power)
+ continue;
+
++ if (chan->flag & HOSTAPD_CHAN_INDOOR_ONLY && iface->conf->country[2] == 0x4f)
++ continue;
++
+ if (ret_chan && idx == channel_idx) {
+ wpa_printf(MSG_DEBUG, "Selected channel %d (%d)",
+ chan->freq, chan->chan);
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
new file mode 100644
index 0000000..e78a4ef
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
@@ -0,0 +1,33 @@
+From f0e9f5aab52b3eab85d28338cc996972ced4c39c Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Tue, 17 May 2022 23:07:59 +0200
+Subject: [PATCH] ctrl: make WNM_AP functions dependant on CONFIG_AP
+
+This fixes linking errors found when compiling wpa_supplicant with
+CONFIG_WNM_AP enabled but CONFIG_AP disabled.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ wpa_supplicant/ctrl_iface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/wpa_supplicant/ctrl_iface.c
++++ b/wpa_supplicant/ctrl_iface.c
+@@ -12241,7 +12241,7 @@ char * wpa_supplicant_ctrl_iface_process
+ if (wpas_ctrl_iface_coloc_intf_report(wpa_s, buf + 18))
+ reply_len = -1;
+ #endif /* CONFIG_WNM */
+-#ifdef CONFIG_WNM_AP
++#if defined(CONFIG_AP) && defined(CONFIG_WNM_AP)
+ } else if (os_strncmp(buf, "DISASSOC_IMMINENT ", 18) == 0) {
+ if (ap_ctrl_iface_disassoc_imminent(wpa_s, buf + 18))
+ reply_len = -1;
+@@ -12251,7 +12251,7 @@ char * wpa_supplicant_ctrl_iface_process
+ } else if (os_strncmp(buf, "BSS_TM_REQ ", 11) == 0) {
+ if (ap_ctrl_iface_bss_tm_req(wpa_s, buf + 11))
+ reply_len = -1;
+-#endif /* CONFIG_WNM_AP */
++#endif /* CONFIG_AP && CONFIG_WNM_AP */
+ } else if (os_strcmp(buf, "FLUSH") == 0) {
+ wpa_supplicant_ctrl_iface_flush(wpa_s);
+ } else if (os_strncmp(buf, "RADIO_WORK ", 11) == 0) {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/992-openssl-include-rsa.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/992-openssl-include-rsa.patch
new file mode 100644
index 0000000..581ae9f
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/992-openssl-include-rsa.patch
@@ -0,0 +1,32 @@
+From f374d52079111a4340acb6df835f45ac6b5f3f60 Mon Sep 17 00:00:00 2001
+From: Andre Heider <a.heider@gmail.com>
+Date: Wed, 22 Jun 2022 14:13:55 +0200
+Subject: OpenSSL: Include rsa.h for all OpenSSL versions
+
+This fixes the build with OpenSSL 1.1.1:
+../src/crypto/crypto_openssl.c: In function 'crypto_rsa_oaep_sha256_decrypt':
+../src/crypto/crypto_openssl.c:4404:49: error: 'RSA_PKCS1_OAEP_PADDING' undeclared (first use in this function)
+
+Signed-off-by: Andre Heider <a.heider@gmail.com>
+---
+ src/crypto/crypto_openssl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/crypto/crypto_openssl.c
++++ b/src/crypto/crypto_openssl.c
+@@ -16,6 +16,7 @@
+ #include <openssl/dh.h>
+ #include <openssl/hmac.h>
+ #include <openssl/rand.h>
++#include <openssl/rsa.h>
+ #include <openssl/pem.h>
+ #ifdef CONFIG_ECC
+ #include <openssl/ec.h>
+@@ -25,7 +26,6 @@
+ #include <openssl/provider.h>
+ #include <openssl/core_names.h>
+ #include <openssl/param_build.h>
+-#include <openssl/rsa.h>
+ #include <openssl/encoder.h>
+ #include <openssl/decoder.h>
+ #else /* OpenSSL version >= 3.0 */
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
new file mode 100644
index 0000000..28af8ef
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
@@ -0,0 +1,475 @@
+From af1bd5256cc764fb222f9809996851ff3d879699 Mon Sep 17 00:00:00 2001
+From: "howard.hsu" <howard-yh.hsu@mediatek.com>
+Date: Wed, 19 Jan 2022 19:18:07 +0800
+Subject: [PATCH 99900/99909] hostapd: mtk: Add neighbor report and BSS
+ Termination for MBO certification
+
+1. Add hostapd_neighbor_count() and hostapd_neighbor_insert_buffer ()
+The first function can count the number of neighbor report in neighbore report
+database. The second can iterate neighbor report database to build up neighbor
+report data.
+
+2. Support including neighbor report elements in ANQP response
+3. Support including neignbor report elements in BTM response
+4. Support configuring BSS Termination TSF by using hostapd_cli command
+5. Disable interface if BSS Termination TSF is set
+6. Add set_send_disassoc_frame_timer() to send disassociate frame
+Function set_disassoc_timer() may fail if key was deleted first. This new
+function will not ask to delete key as set_disassoc_timer() did.
+7. Support including neighbor report elements in BTM request
+8. Add hostapd_neighbor_set_own_report_pref()
+9. Add hostapd_neighbor_set_pref_by_non_pref_chan()
+---
+ hostapd/ctrl_iface.c | 5 ++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 1 +
+ src/ap/ctrl_iface_ap.c | 19 ++++++-
+ src/ap/gas_serv.c | 29 ++++++++++
+ src/ap/gas_serv.h | 2 +
+ src/ap/neighbor_db.c | 119 +++++++++++++++++++++++++++++++++++++++++
+ src/ap/neighbor_db.h | 9 ++++
+ src/ap/wnm_ap.c | 72 +++++++++++++++++++++++--
+ 9 files changed, 252 insertions(+), 5 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index a258492..c2a2822 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1338,6 +1338,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
+ #endif /* CONFIG_DPP */
+ } else if (os_strcasecmp(cmd, "setband") == 0) {
+ ret = hostapd_ctrl_iface_set_band(hapd, value);
++ } else if (os_strcasecmp(cmd, "bss_termination_tsf") == 0) {
++ int termination_sec = atoi(value);
++ hapd->conf->bss_termination_tsf = termination_sec;
++ wpa_printf(MSG_DEBUG, "BSS Termination TSF: value = %d",
++ termination_sec);
+ } else {
+ ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
+ if (ret)
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index d7a0c7c..4a20eb4 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
+ /* comeback after 10 TUs */
+ bss->pasn_comeback_after = 10;
+ #endif /* CONFIG_PASN */
++ bss->bss_termination_tsf = 0;
+ }
+
+
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index ed3bec7..3f68e76 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -557,6 +557,7 @@ struct hostapd_bss_config {
+ int wnm_sleep_mode;
+ int wnm_sleep_mode_no_keys;
+ int bss_transition;
++ unsigned int bss_termination_tsf;
+
+ /* IEEE 802.11u - Interworking */
+ int interworking;
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index 96209ce..18bae5c 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1203,6 +1203,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ wpa_printf(MSG_DEBUG, "Invalid bss_term data");
+ return -1;
+ }
++ if (hapd->conf->bss_termination_tsf) {
++ WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
++ }
++
+ end++;
+ WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
+ }
+@@ -1229,14 +1233,25 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
+ }
+
+- if (os_strstr(cmd, " pref=1"))
++ if (os_strstr(cmd, " pref=1")) {
+ req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++ if (nei_len == 0) {
++ // Add neigibor report from neighbor report db to nei_rep buffer
++ nei_len = hostapd_neighbor_insert_buffer (hapd, nei_rep, 1000);
++ }
++ }
+ if (os_strstr(cmd, " abridged=1"))
+ req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
+- if (os_strstr(cmd, " disassoc_imminent=1"))
++ if (os_strstr(cmd, " disassoc_imminent=1")) {
+ req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
++ /* Set own BSS neighbor report preference value as 0 */
++ hostapd_neighbor_set_own_report_pref(hapd, nei_rep, nei_len, 0);
++ }
++
+
+ #ifdef CONFIG_MBO
++ hostapd_neighbor_set_pref_by_non_pref_chan(hapd, sta, nei_rep, nei_len);
++
+ pos = os_strstr(cmd, "mbo=");
+ if (pos) {
+ unsigned int mbo_reason, cell_pref, reassoc_delay;
+diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
+index 90f1577..5845ff8 100644
+--- a/src/ap/gas_serv.c
++++ b/src/ap/gas_serv.c
+@@ -19,6 +19,7 @@
+ #include "dpp_hostapd.h"
+ #include "sta_info.h"
+ #include "gas_serv.h"
++#include "neighbor_db.h"
+
+
+ #ifdef CONFIG_DPP
+@@ -369,6 +370,24 @@ static void anqp_add_network_auth_type(struct hostapd_data *hapd,
+ }
+ }
+
++static void anqp_add_neighbor_report(struct hostapd_data *hapd,
++ struct wpabuf *buf)
++{
++ struct hostapd_neighbor_entry *nr;
++ u8 *len_pos = gas_anqp_add_element(buf, ANQP_NEIGHBOR_REPORT);
++ if (dl_list_empty(&hapd->nr_db)) {
++ wpabuf_put_le16(buf, 0);
++ }
++ else {
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry, list ) {
++ wpabuf_put_u8(buf, WLAN_EID_NEIGHBOR_REPORT);
++ wpabuf_put_u8(buf, wpabuf_len(nr->nr));
++ wpabuf_put_buf(buf, nr->nr);
++ }
++ }
++ gas_anqp_set_element_len(buf, len_pos);
++}
++
+
+ static void anqp_add_roaming_consortium(struct hostapd_data *hapd,
+ struct wpabuf *buf)
+@@ -986,6 +1005,9 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ len += 1000;
+ if (request & ANQP_REQ_ICON_REQUEST)
+ len += 65536;
++ if (request & ANQP_REQ_NEIGHBOR_REPORT) {
++ len += (40 * hostapd_neighbor_count(hapd));
++ }
+ #ifdef CONFIG_FILS
+ if (request & ANQP_FILS_REALM_INFO)
+ len += 2 * dl_list_len(&hapd->conf->fils_realms);
+@@ -1028,6 +1050,8 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ anqp_add_elem(hapd, buf, ANQP_TDLS_CAPABILITY);
+ if (request & ANQP_REQ_EMERGENCY_NAI)
+ anqp_add_elem(hapd, buf, ANQP_EMERGENCY_NAI);
++ if (request & ANQP_REQ_NEIGHBOR_REPORT)
++ anqp_add_neighbor_report(hapd, buf);
+
+ for (i = 0; i < num_extra_req; i++) {
+ #ifdef CONFIG_FILS
+@@ -1172,6 +1196,11 @@ static void rx_anqp_query_list_id(struct hostapd_data *hapd, u16 info_id,
+ "Emergency NAI",
+ get_anqp_elem(hapd, info_id) != NULL, qi);
+ break;
++ case ANQP_NEIGHBOR_REPORT:
++ set_anqp_req(ANQP_REQ_NEIGHBOR_REPORT,
++ "Neighbor Report",
++ get_anqp_elem(hapd, info_id) != NULL, qi);
++ break;
+ default:
+ #ifdef CONFIG_FILS
+ if (info_id == ANQP_FILS_REALM_INFO &&
+diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
+index 1528af4..d0241f2 100644
+--- a/src/ap/gas_serv.h
++++ b/src/ap/gas_serv.h
+@@ -40,6 +40,8 @@
+ (1 << (ANQP_TDLS_CAPABILITY - ANQP_QUERY_LIST))
+ #define ANQP_REQ_EMERGENCY_NAI \
+ (1 << (ANQP_EMERGENCY_NAI - ANQP_QUERY_LIST))
++#define ANQP_REQ_NEIGHBOR_REPORT \
++ (1 << (ANQP_NEIGHBOR_REPORT - ANQP_QUERY_LIST))
+ /*
+ * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
+ * optimized bitmap.
+diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
+index 52f25eb..9254d09 100644
+--- a/src/ap/neighbor_db.c
++++ b/src/ap/neighbor_db.c
+@@ -89,6 +89,38 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
+ }
+
+
++int hostapd_neighbor_count(struct hostapd_data *hapd)
++{
++ struct hostapd_neighbor_entry *nr;
++ int count = 0;
++
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ count++;
++ }
++ return count;
++}
++
++
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++ size_t buflen)
++{
++ struct hostapd_neighbor_entry *nr;
++ char *pos = buf;
++
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ /* For neighbor report IE, we only need bssid and nr*/
++ *pos++ = WLAN_EID_NEIGHBOR_REPORT;
++ *pos++ = wpabuf_len(nr->nr);
++ os_memcpy(pos, wpabuf_head(nr->nr), wpabuf_len(nr->nr));
++ pos += wpabuf_len(nr->nr);
++ }
++
++ return pos - buf;
++}
++
++
+ static void hostapd_neighbor_clear_entry(struct hostapd_neighbor_entry *nr)
+ {
+ wpabuf_free(nr->nr);
+@@ -325,3 +357,90 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
+ wpabuf_free(nr);
+ #endif /* NEED_AP_MLME */
+ }
++
++
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++ size_t buflen, const int pref)
++{
++ struct hostapd_neighbor_entry *nr;
++ char *pos, *next_nr;
++
++ pos = nei_buf;
++ next_nr = nei_buf;
++
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ pos = next_nr;
++ next_nr = pos + 2 + wpabuf_len(nr->nr);
++ /* Shift 2 bytes for Element ID and Neighbor report length */
++ pos = pos + 2;
++ if(os_memcmp(pos, hapd->own_addr, ETH_ALEN) == 0) {
++ /* Shift for BSSID + BSSID info + Op_class + channel num + PHY type */
++ pos = pos + 6 + 4 + 1 + 1 + 1;
++
++ /* Iterate Subelement */
++ while (next_nr - pos > 0) {
++ if (*pos == 3) {
++ pos = pos + 2;
++ *pos = pref;
++ return;
++ } else {
++ pos++;
++ int shift_len = *pos++;
++ pos = pos + shift_len;
++ }
++ }
++ }
++ }
++}
++
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++ struct sta_info* sta, char *nei_buf, size_t buflen)
++{
++ struct hostapd_neighbor_entry *nr;
++ struct mbo_non_pref_chan_info *info;
++ u8 i;
++
++ for(info = sta->non_pref_chan; info; info = info->next) {
++ /* Check OP_Class and Channel num */
++ for(i = 0; i < info->num_channels; i++) {
++ char *pos, *next_nr;
++
++ pos = nei_buf;
++ next_nr = nei_buf;
++
++ /* Iterate Neighbor report database */
++ dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++ list) {
++ pos = next_nr;
++ next_nr = pos + 2 + wpabuf_len(nr->nr);
++ /**
++ * Shift 12 bytes for Element ID, Neighbor report length,
++ * BSSID and BSSID info.
++ */
++ pos = pos + 12;
++ int nr_op_class = *pos++;
++ int nr_channel = *pos;
++ if(info->op_class == nr_op_class && info->channels[i] == nr_channel) {
++ /* Shift for Channel Num + PHY type */
++ pos = pos + 1 + 1;
++
++ // Iterate Subelement
++ while(next_nr - pos > 0) {
++ if(*pos == 3) {
++ pos = pos + 2;
++ *pos = info->pref;
++ break;
++ }else {
++ pos++;
++ int shift_len = *pos++;
++ pos = pos + shift_len;
++ }
++ }
++ }
++ }
++ }
++ }
++}
++#endif
+diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
+index 992671b..a1ddc07 100644
+--- a/src/ap/neighbor_db.h
++++ b/src/ap/neighbor_db.h
+@@ -24,4 +24,13 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
+ const struct wpa_ssid_value *ssid);
+ void hostapd_free_neighbor_db(struct hostapd_data *hapd);
+
++int hostapd_neighbor_count(struct hostapd_data *hapd);
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++ size_t buflen);
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++ size_t buflen, const int pref);
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++ struct sta_info* sta, char *nei_buf, size_t buflen);
++#endif
+ #endif /* NEIGHBOR_DB_H */
+diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
+index 3ea92af..4349e1d 100644
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -20,6 +20,7 @@
+ #include "ap/wpa_auth.h"
+ #include "mbo_ap.h"
+ #include "wnm_ap.h"
++#include "ap/neighbor_db.h"
+
+ #define MAX_TFS_IE_LEN 1024
+
+@@ -370,9 +371,21 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ u8 *pos;
+ int res;
+
+- mgmt = os_zalloc(sizeof(*mgmt));
+- if (mgmt == NULL)
++ int nr_num = hostapd_neighbor_count(hapd);
++ int nr_size = ETH_ALEN + 4 + 1 + 1 + 1 + 5;
++ int total_nr_size = nr_num * nr_size;
++ u8 *nr_data = os_malloc(total_nr_size);
++ int nr_data_len = 0;
++ if(nr_data == NULL) {
++ wpa_printf (MSG_ERROR, "Failed to allocate memory");
++ } else {
++ nr_data_len = hostapd_neighbor_insert_buffer(hapd, nr_data, total_nr_size);
++ }
++ mgmt = os_zalloc(sizeof(*mgmt) + nr_data_len);
++ if (mgmt == NULL) {
++ wpa_printf (MSG_ERROR, "Failed to allocate memory for mgmt frame");
+ return -1;
++ }
+ os_memcpy(mgmt->da, addr, ETH_ALEN);
+ os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
+ os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
+@@ -382,10 +395,18 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ;
+ mgmt->u.action.u.bss_tm_req.dialog_token = dialog_token;
+ mgmt->u.action.u.bss_tm_req.req_mode = 0;
++ if(nr_num) {
++ mgmt->u.action.u.bss_tm_req.req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++ }
+ mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(0);
+ mgmt->u.action.u.bss_tm_req.validity_interval = 1;
+ pos = mgmt->u.action.u.bss_tm_req.variable;
+
++ if(nr_num) {
++ os_memcpy(pos, nr_data, nr_data_len);
++ pos += nr_data_len;
++ }
++
+ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
+ MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
+@@ -759,6 +780,50 @@ static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta,
+ }
+
+
++static void set_send_disassoc_frame_timer(struct hostapd_data *hapd, struct sta_info *sta,
++ int disassoc_timer)
++{
++ int timeout, beacon_int;
++
++ /*
++ * Prevent STA from reconnecting using cached PMKSA to force
++ * full authentication with the authentication server (which may
++ * decide to reject the connection),
++ */
++ wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
++
++ beacon_int = hapd->iconf->beacon_int;
++ if (beacon_int < 1)
++ beacon_int = 100; /* best guess */
++ /* Calculate timeout in ms based on beacon_int in TU */
++ timeout = disassoc_timer * beacon_int * 128 / 125;
++ wpa_printf(MSG_DEBUG, "Disassociation timer for " MACSTR
++ " set to %d ms", MAC2STR(sta->addr), timeout);
++
++ u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID;
++
++ hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
++ if (sta)
++ ap_sta_disassociate(hapd, sta, reason);
++}
++
++
++void bss_termination_disable_iface(void *eloop_ctx, void *timeout_ctx)
++{
++ struct hostapd_data *hapd = eloop_ctx;
++ hostapd_disable_iface(hapd->iface);
++}
++
++
++static void set_disable_iface_timer(struct hostapd_data *hapd, struct sta_info *sta,
++ int disable_iface_timer)
++{
++ wpa_printf(MSG_DEBUG, "Disable interface timer set to %d secs", disable_iface_timer);
++ eloop_register_timeout(disable_iface_timer, 0,
++ bss_termination_disable_iface, hapd, NULL);
++}
++
++
+ int wnm_send_ess_disassoc_imminent(struct hostapd_data *hapd,
+ struct sta_info *sta, const char *url,
+ int disassoc_timer)
+@@ -848,6 +913,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ bss_term_dur) {
+ os_memcpy(pos, bss_term_dur, 12);
+ pos += 12;
++ set_disable_iface_timer(hapd, sta, hapd->conf->bss_termination_tsf);
+ }
+
+ if (url) {
+@@ -884,7 +950,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ if (disassoc_timer) {
+ /* send disassociation frame after time-out */
+- set_disassoc_timer(hapd, sta, disassoc_timer);
++ set_send_disassoc_frame_timer(hapd, sta, disassoc_timer);
+ }
+
+ return 0;
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
new file mode 100644
index 0000000..054dfb0
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
@@ -0,0 +1,36 @@
+From f5c37c459c33bb8e228a88ba8efdea68bb75abd3 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 20 Sep 2022 19:33:45 +0800
+Subject: [PATCH 99901/99909] hostapd: mtk: print sae groups by hostapd ctrl
+
+---
+ hostapd/ctrl_iface.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c2a2822..bc690c5 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1412,6 +1412,19 @@ static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
+ if (os_snprintf_error(buflen, res))
+ return -1;
+ return res;
++ } else if (os_strcmp(cmd, "sae_group_capability") == 0) {
++#ifdef CONFIG_SAE
++ /* see sae_set_group() */
++ res = os_snprintf(buf, buflen, "%s%s%s%s19 20 21",
++ dh_groups_get(15) ? "15 ": "",
++ dh_groups_get(16) ? "16 ": "",
++ dh_groups_get(17) ? "17 ": "",
++ dh_groups_get(18) ? "18 ": "");
++
++ if (os_snprintf_error(buflen, res))
++ return -1;
++ return res;
++#endif /* CONFIG_SAE */
+ }
+
+ return -1;
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
new file mode 100644
index 0000000..6fa23c0
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
@@ -0,0 +1,211 @@
+From ce684a1adac0b5b699482924eb86f8f1b8205e57 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Tue, 31 May 2022 21:15:54 +0800
+Subject: [PATCH 99902/99909] hostapd: mtk: add support for runtime set in-band
+ discovery
+
+Usage:
+hostapd_cli unsolic_probe_resp [tx_type] [interval]
+
+0: disable all in-band discovery
+1: enable unsolicited probe response
+2: enable FILS discovery
+
+Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 66 ++++++++++++++++++++++++++++++++++++
+ hostapd/hostapd_cli.c | 20 +++++++++++
+ src/ap/beacon.c | 5 ++-
+ src/drivers/driver_nl80211.c | 10 ++++--
+ src/drivers/nl80211_copy.h | 1 +
+ 5 files changed, 98 insertions(+), 4 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index bc690c5..bb8c74f 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -826,6 +826,69 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
+
+ #endif /* CONFIG_INTERWORKING */
+
++static int hostapd_ctrl_iface_inband_discovery(struct hostapd_data *hapd,
++ const char *cmd)
++{
++ struct hostapd_bss_config *conf = hapd->conf;
++ const char *pos = cmd;
++ int tx_type, interval, ret;
++
++ tx_type = atoi(pos);
++ if (tx_type < 0 || tx_type > 2) {
++ wpa_printf(MSG_ERROR, "Invalid tx type\n");
++ return -1;
++ }
++
++ pos = os_strchr(pos, ' ');
++ if(!pos)
++ return -1;
++ pos++;
++ interval = atoi(pos);
++ if (interval < 0 || interval > 20) {
++ wpa_printf(MSG_ERROR, "Invalid interval value\n");
++ return -1;
++ }
++
++ wpa_printf(MSG_ERROR, "Set inband discovery type:%d, interval:%d\n",
++ tx_type, interval);
++
++#define DISABLE_INBAND_DISC 0
++#define UNSOL_PROBE_RESP 1
++#define FILS_DISCOVERY 2
++
++#ifdef CONFIG_FILS
++ conf->fils_discovery_max_int = 0;
++ conf->fils_discovery_min_int = 0;
++#endif /* CONFIG_FILS */
++ conf->unsol_bcast_probe_resp_interval = 0;
++
++ switch (tx_type) {
++ case DISABLE_INBAND_DISC:
++ default:
++ /* Disable both Unsolicited probe response and FILS discovery*/
++ break;
++ case UNSOL_PROBE_RESP:
++ /* Enable Unsolicited probe response */
++ conf->unsol_bcast_probe_resp_interval = interval;
++ break;
++#ifdef CONFIG_FILS
++ case FILS_DISCOVERY:
++ /* Enable FILS discovery */
++ conf->fils_discovery_min_int = interval;
++ conf->fils_discovery_max_int = interval;
++ break;
++#endif /* CONFIG_FILS */
++ }
++
++ ret = ieee802_11_update_beacons(hapd->iface);
++ if(ret) {
++ wpa_printf(MSG_DEBUG,
++ "Failed to update with inband discovery parameters\n");
++ return -1;
++ }
++
++ return 0;
++}
+
+ #ifdef CONFIG_WNM_AP
+
+@@ -3434,6 +3497,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ if (hostapd_ctrl_iface_coloc_intf_req(hapd, buf + 15))
+ reply_len = -1;
+ #endif /* CONFIG_WNM_AP */
++ } else if (os_strncmp(buf, "INBAND_DISCOVERY ", 17) == 0) {
++ if (hostapd_ctrl_iface_inband_discovery(hapd, buf + 17))
++ reply_len = -1;
+ } else if (os_strcmp(buf, "GET_CONFIG") == 0) {
+ reply_len = hostapd_ctrl_iface_get_config(hapd, reply,
+ reply_size);
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 85c41d0..db21258 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -642,6 +642,24 @@ static int hostapd_cli_cmd_wps_config(struct wpa_ctrl *ctrl, int argc,
+ return wpa_ctrl_command(ctrl, buf);
+ }
+
++static int hostapd_cli_cmd_inband_discovery(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ char buf[300];
++ int res;
++
++ if (argc < 2) {
++ printf("Invalid 'inband_discovery' command - two arguments"
++ "tx_type interval\n");
++ return -1;
++ }
++
++ res = os_snprintf(buf, sizeof(buf), "INBAND_DISCOVERY %s %s",
++ argv[0], argv[1]);
++ if (os_snprintf_error(sizeof(buf), res))
++ return -1;
++ return wpa_ctrl_command(ctrl, buf);
++}
+
+ static int hostapd_cli_cmd_disassoc_imminent(struct wpa_ctrl *ctrl, int argc,
+ char *argv[])
+@@ -1749,6 +1767,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ { "driver", hostapd_cli_cmd_driver, NULL,
+ "<driver sub command> [<hex formatted data>] = send driver command data" },
+ #endif /* ANDROID */
++ { "inband_discovery", hostapd_cli_cmd_inband_discovery, NULL,
++ "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
+ { NULL, NULL, NULL, NULL }
+ };
+
+diff --git a/src/ap/beacon.c b/src/ap/beacon.c
+index 814e86e..1a26f11 100644
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1497,6 +1497,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+ struct wpa_driver_ap_params *params)
+ {
+ params->fd_max_int = hapd->conf->fils_discovery_max_int;
++ params->unsol_bcast_probe_resp_interval =
++ hapd->conf->unsol_bcast_probe_resp_interval;
+ if (is_6ghz_op_class(hapd->iconf->op_class) &&
+ params->fd_max_int > FD_MAX_INTERVAL_6GHZ)
+ params->fd_max_int = FD_MAX_INTERVAL_6GHZ;
+@@ -1505,7 +1507,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+ if (params->fd_min_int > params->fd_max_int)
+ params->fd_min_int = params->fd_max_int;
+
+- if (params->fd_max_int)
++ if (params->fd_max_int || (is_6ghz_op_class(hapd->iconf->op_class) &&
++ !params->unsol_bcast_probe_resp_interval))
+ return hostapd_gen_fils_discovery(hapd,
+ ¶ms->fd_frame_tmpl_len);
+
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 53f2503..5eba0ea 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -4498,9 +4498,10 @@ static int nl80211_fils_discovery(struct i802_bss *bss, struct nl_msg *msg,
+ params->fd_max_int) ||
+ (params->fd_frame_tmpl &&
+ nla_put(msg, NL80211_FILS_DISCOVERY_ATTR_TMPL,
+- params->fd_frame_tmpl_len, params->fd_frame_tmpl)))
++ params->fd_frame_tmpl_len, params->fd_frame_tmpl)) ||
++ nla_put_u32(msg, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
++ params->unsol_bcast_probe_resp_interval))
+ return -1;
+-
+ nla_nest_end(msg, attr);
+ return 0;
+ }
+@@ -4844,7 +4845,10 @@ static int wpa_driver_nl80211_set_ap(void *priv,
+ #endif /* CONFIG_SAE */
+
+ #ifdef CONFIG_FILS
+- if (params->fd_max_int && nl80211_fils_discovery(bss, msg, params) < 0)
++ if ((params->fd_max_int ||
++ ((params->freq->freq > 5950 && params->freq->freq <= 7115) &&
++ !(params->unsol_bcast_probe_resp_interval))) &&
++ nl80211_fils_discovery(bss, msg, params) < 0)
+ goto fail;
+ #endif /* CONFIG_FILS */
+
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index 0568a79..c4bf3ad 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -7379,6 +7379,7 @@ enum nl80211_fils_discovery_attributes {
+ NL80211_FILS_DISCOVERY_ATTR_INT_MIN,
+ NL80211_FILS_DISCOVERY_ATTR_INT_MAX,
+ NL80211_FILS_DISCOVERY_ATTR_TMPL,
++ NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
+
+ /* keep last */
+ __NL80211_FILS_DISCOVERY_ATTR_LAST,
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99903-hostapd-mtk-Add-mtk_vendor.h.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99903-hostapd-mtk-Add-mtk_vendor.h.patch
new file mode 100644
index 0000000..a15287e
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99903-hostapd-mtk-Add-mtk_vendor.h.patch
@@ -0,0 +1,214 @@
+From e4b9b5847090d25009a4cf104052ba0490e95ffe Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Mon, 30 May 2022 15:04:57 +0800
+Subject: [PATCH 99903/99909] hostapd: mtk: Add mtk_vendor.h
+
+---
+ src/common/mtk_vendor.h | 195 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 195 insertions(+)
+ create mode 100644 src/common/mtk_vendor.h
+
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+new file mode 100644
+index 0000000..528387f
+--- /dev/null
++++ b/src/common/mtk_vendor.h
+@@ -0,0 +1,195 @@
++// SPDX-License-Identifier: ISC
++/* Copyright (C) 2020 Felix Fietkau <nbd@nbd.name> */
++#ifndef MTK_VENDOR_H
++#define MTK_VENDOR_H
++
++#define OUI_MTK 0x000ce7
++
++enum mtk_nl80211_vendor_subcmds {
++ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
++ MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
++ MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
++ MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++};
++
++enum mtk_vendor_attr_edcca_ctrl {
++ MTK_VENDOR_ATTR_EDCCA_THRESHOLD_INVALID = 0,
++
++ MTK_VENDOR_ATTR_EDCCA_CTRL_MODE,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL,
++ MTK_VENDOR_ATTR_EDCCA_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
++};
++
++enum mtk_vendor_attr_edcca_ctrl_mode {
++ EDCCA_CTRL_SET_EN = 0,
++ EDCCA_CTRL_SET_THERS,
++ EDCCA_CTRL_GET_EN,
++ EDCCA_CTRL_GET_THERS,
++ EDCCA_CTRL_NUM,
++};
++
++static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
++};
++
++enum mtk_vendor_attr_csi_ctrl {
++ MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1,
++ MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2,
++ MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR,
++ MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM,
++
++ MTK_VENDOR_ATTR_CSI_CTRL_DATA,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_CSI_CTRL,
++ MTK_VENDOR_ATTR_CSI_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_CSI_CTRL - 1
++};
++
++enum mtk_vendor_attr_csi_data {
++ MTK_VENDOR_ATTR_CSI_DATA_UNSPEC,
++ MTK_VENDOR_ATTR_CSI_DATA_PAD,
++
++ MTK_VENDOR_ATTR_CSI_DATA_VER,
++ MTK_VENDOR_ATTR_CSI_DATA_TS,
++ MTK_VENDOR_ATTR_CSI_DATA_RSSI,
++ MTK_VENDOR_ATTR_CSI_DATA_SNR,
++ MTK_VENDOR_ATTR_CSI_DATA_BW,
++ MTK_VENDOR_ATTR_CSI_DATA_CH_IDX,
++ MTK_VENDOR_ATTR_CSI_DATA_TA,
++ MTK_VENDOR_ATTR_CSI_DATA_I,
++ MTK_VENDOR_ATTR_CSI_DATA_Q,
++ MTK_VENDOR_ATTR_CSI_DATA_INFO,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD1,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD2,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD3,
++ MTK_VENDOR_ATTR_CSI_DATA_RSVD4,
++ MTK_VENDOR_ATTR_CSI_DATA_TX_ANT,
++ MTK_VENDOR_ATTR_CSI_DATA_RX_ANT,
++ MTK_VENDOR_ATTR_CSI_DATA_MODE,
++ MTK_VENDOR_ATTR_CSI_DATA_H_IDX,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_CSI_DATA,
++ MTK_VENDOR_ATTR_CSI_DATA_MAX =
++ NUM_MTK_VENDOR_ATTRS_CSI_DATA - 1
++};
++
++enum mtk_vendor_attr_mnt_ctrl {
++ MTK_VENDOR_ATTR_AMNT_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_CTRL_SET,
++ MTK_VENDOR_ATTR_AMNT_CTRL_DUMP,
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_CTRL,
++ MTK_VENDOR_ATTR_AMNT_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_CTRL - 1
++};
++
++enum mtk_vendor_attr_mnt_set {
++ MTK_VENDOR_ATTR_AMNT_SET_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_SET_INDEX,
++ MTK_VENDOR_ATTR_AMNT_SET_MACADDR,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_SET,
++ MTK_VENDOR_ATTR_AMNT_SET_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_SET - 1
++};
++
++enum mtk_vendor_attr_mnt_dump {
++ MTK_VENDOR_ATTR_AMNT_DUMP_UNSPEC,
++
++ MTK_VENDOR_ATTR_AMNT_DUMP_INDEX,
++ MTK_VENDOR_ATTR_AMNT_DUMP_LEN,
++ MTK_VENDOR_ATTR_AMNT_DUMP_RESULT,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_AMNT_DUMP,
++ MTK_VENDOR_ATTR_AMNT_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_AMNT_DUMP - 1
++};
++
++enum mtk_vendor_attr_wireless_ctrl {
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_OFDMA,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
++ MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
++};
++
++enum mtk_vendor_attr_rfeature_ctrl {
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL,
++ MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
++};
++
++#define CSI_MAX_COUNT 256
++#define ETH_ALEN 6
++
++struct csi_data {
++ s16 data_i[CSI_MAX_COUNT];
++ s16 data_q[CSI_MAX_COUNT];
++ s8 rssi;
++ u8 snr;
++ u32 ts;
++ u8 data_bw;
++ u8 pri_ch_idx;
++ u8 ta[ETH_ALEN];
++ u32 info;
++ u8 rx_mode;
++ u32 h_idx;
++ u16 tx_idx;
++ u16 rx_idx;
++};
++
++struct amnt_data {
++ u8 idx;
++ u8 addr[ETH_ALEN];
++ s8 rssi[4];
++ u32 last_seen;
++};
++#endif /* MTK_VENDOR_H */
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
new file mode 100644
index 0000000..40dded6
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
@@ -0,0 +1,619 @@
+From cef7f515eafeeaa99933cc9e66c79b705e3ab065 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Mon, 30 May 2022 16:31:34 +0800
+Subject: [PATCH 99904/99909] hostapd: mtk: Support EDCCA hostapd configuration
+
+edcca_enable and edcca_compensation and implement edcca related handlers.
+---
+ hostapd/config_file.c | 32 ++++++
+ hostapd/ctrl_iface.c | 125 ++++++++++++++++++++++
+ src/ap/ap_config.c | 4 +
+ src/ap/ap_config.h | 29 ++++++
+ src/ap/ap_drv_ops.c | 24 +++++
+ src/ap/ap_drv_ops.h | 5 +-
+ src/ap/hostapd.c | 7 ++
+ src/common/mtk_vendor.h | 19 ++--
+ src/drivers/driver.h | 4 +
+ src/drivers/driver_nl80211.c | 165 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 7 ++
+ 12 files changed, 415 insertions(+), 7 deletions(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index eda9db0..0ee8952 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4753,6 +4753,38 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ } else if (os_strcmp(buf, "eht_mu_beamformer") == 0) {
+ conf->eht_phy_capab.mu_beamformer = atoi(pos);
+ #endif /* CONFIG_IEEE80211BE */
++ } else if (os_strcmp(buf, "edcca_threshold") == 0) {
++ if (hostapd_parse_intlist(&conf->edcca_threshold, pos) ||
++ conf->edcca_threshold[0] < EDCCA_MIN_CONFIG_THRES ||
++ conf->edcca_threshold[0] > EDCCA_MAX_CONFIG_THRES ||
++ conf->edcca_threshold[1] < EDCCA_MIN_CONFIG_THRES ||
++ conf->edcca_threshold[1] > EDCCA_MAX_CONFIG_THRES ||
++ conf->edcca_threshold[2] < EDCCA_MIN_CONFIG_THRES ||
++ conf->edcca_threshold[2] > EDCCA_MAX_CONFIG_THRES) {
++ wpa_printf(MSG_ERROR, "Line %d: invalid edcca threshold",
++ line);
++ return 1;
++ }
++ } else if (os_strcmp(buf, "edcca_enable") == 0) {
++ int mode = atoi(pos);
++ if (mode < EDCCA_MODE_FORCE_DISABLE || mode > EDCCA_MODE_AUTO) {
++ wpa_printf(MSG_ERROR, "Line %d: Invalid edcca_enable %d;"
++ " allowed value 0 (Force Disable) or 1(Auto) ",
++ line, mode);
++ return 1;
++ }
++ conf->edcca_enable = (u8) mode;
++ } else if (os_strcmp(buf, "edcca_compensation") == 0) {
++ int val = atoi(pos);
++ if (val < EDCCA_MIN_COMPENSATION ||
++ val > EDCCA_MAX_COMPENSATION) {
++ wpa_printf(MSG_ERROR, "Line %d: Invalid compensation"
++ " value %d; allowed value %d ~ %d.",
++ line, val, EDCCA_MIN_COMPENSATION,
++ EDCCA_MAX_COMPENSATION);
++ return 1;
++ }
++ conf->edcca_compensation = (s8) val;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index bb8c74f..9c70d54 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -598,6 +598,19 @@ static const char * pbc_status_str(enum pbc_status status)
+ }
+
+
++static const char * edcca_mode_str(enum edcca_mode status)
++{
++ switch (status) {
++ case EDCCA_MODE_FORCE_DISABLE:
++ return "Force Disable";
++ case EDCCA_MODE_AUTO:
++ return "Auto";
++ default:
++ return "Unknown";
++ }
++}
++
++
+ static int hostapd_ctrl_iface_wps_get_status(struct hostapd_data *hapd,
+ char *buf, size_t buflen)
+ {
+@@ -3322,6 +3335,112 @@ static int hostapd_ctrl_iface_driver_cmd(struct hostapd_data *hapd, char *cmd,
+ #endif /* ANDROID */
+
+
++static int
++hostapd_ctrl_iface_set_edcca(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *pos, *config, *value;
++ config = cmd;
++ pos = os_strchr(config, ' ');
++ if (pos == NULL)
++ return -1;
++ *pos++ = '\0';
++
++ if(pos == NULL)
++ return -1;
++ value = pos;
++
++ if (os_strcmp(config, "enable") == 0) {
++ int mode = atoi(value);
++ if (mode < EDCCA_MODE_FORCE_DISABLE || mode > EDCCA_MODE_AUTO) {
++ wpa_printf(MSG_ERROR, "Invalid value for edcca enable");
++ return -1;
++ }
++ hapd->iconf->edcca_enable = (u8) mode;
++ if (hostapd_drv_configure_edcca_enable(hapd) != 0)
++ return -1;
++ } else if (os_strcmp(config, "compensation") == 0) {
++ int compensation = atoi(value);
++ if (compensation < EDCCA_MIN_COMPENSATION ||
++ compensation > EDCCA_MAX_COMPENSATION) {
++ wpa_printf(MSG_ERROR, "Invalid value for edcca compensation");
++ return -1;
++ }
++ hapd->iconf->edcca_compensation = (s8) compensation;
++ if (hostapd_drv_configure_edcca_enable(hapd) != 0)
++ return -1;
++ } else if (os_strcmp(config, "threshold") == 0) {
++ char *thres_value;
++ thres_value = os_strchr(value, ':');
++ if (thres_value == NULL)
++ return -1;
++ *thres_value++ = '\0';
++
++ if(thres_value == NULL)
++ return -1;
++ int bw_idx= atoi(value);
++ int threshold = atoi(thres_value);
++
++ if (bw_idx < EDCCA_BW_20 || bw_idx > EDCCA_BW_80) {
++ wpa_printf(MSG_ERROR,
++ "Unsupported Bandwidth idx %d for SET_EDCCA",
++ bw_idx);
++ return -1;
++ }
++ if (threshold < EDCCA_MIN_CONFIG_THRES ||
++ threshold > EDCCA_MAX_CONFIG_THRES) {
++ wpa_printf(MSG_ERROR,
++ "Unsupported threshold %d for SET_EDCCA",
++ threshold);
++ return -1;
++ }
++
++ int threshold_arr[EDCCA_MAX_BW_NUM];
++ /* 0x7f means keep the origival value in firmware */
++ os_memset(threshold_arr, 0x7f, sizeof(threshold_arr));
++ threshold_arr[bw_idx] = threshold;
++
++ if (hostapd_drv_configure_edcca_threshold(hapd, threshold_arr) != 0)
++ return -1;
++ } else {
++ wpa_printf(MSG_ERROR,
++ "Unsupported parameter %s for SET_EDCCA", config);
++ return -1;
++ }
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++
++static int
++hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
++ size_t buflen)
++{
++ char *pos, *end;
++
++ pos = buf;
++ end = buf + buflen;
++ u8 value[EDCCA_MAX_BW_NUM] = {0};
++
++ if (os_strcmp(cmd, "enable") == 0) {
++ return os_snprintf(pos, end - pos, "Enable: %s\n",
++ edcca_mode_str(hapd->iconf->edcca_enable));
++ } else if (os_strcmp(cmd, "compensation") == 0) {
++ return os_snprintf(pos, end - pos, "Compensation: %d\n",
++ hapd->iconf->edcca_compensation);
++ } else if (os_strcmp(cmd, "threshold") == 0) {
++ if (hostapd_drv_get_edcca(hapd, EDCCA_CTRL_GET_THRES, &value) != 0)
++ return -1;
++ return os_snprintf(pos, end - pos,
++ "Threshold BW20: 0x%x, BW40: 0x%x, BW80: 0x%x\n",
++ value[0], value[1], value[2]);
++ } else {
++ wpa_printf(MSG_ERROR,
++ "Unsupported parameter %s for GET_EDCCA", cmd);
++ return -1;
++ }
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -3868,6 +3987,12 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_len = hostapd_ctrl_iface_driver_cmd(hapd, buf + 7, reply,
+ reply_size);
+ #endif /* ANDROID */
++ } else if (os_strncmp(buf, "SET_EDCCA ", 10) == 0) {
++ reply_len = hostapd_ctrl_iface_set_edcca(hapd, buf+10, reply,
++ reply_size);
++ } else if (os_strncmp(buf, "GET_EDCCA ", 10) == 0) {
++ reply_len = hostapd_ctrl_iface_get_edcca(hapd, buf+10, reply,
++ reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 4a20eb4..344585a 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -294,6 +294,9 @@ struct hostapd_config * hostapd_config_defaults(void)
+ conf->airtime_update_interval = AIRTIME_DEFAULT_UPDATE_INTERVAL;
+ #endif /* CONFIG_AIRTIME_POLICY */
+
++ conf->edcca_enable = EDCCA_MODE_AUTO;
++ conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
++
+ return conf;
+ }
+
+@@ -1007,6 +1010,7 @@ void hostapd_config_free(struct hostapd_config *conf)
+ #ifdef CONFIG_ACS
+ os_free(conf->acs_chan_bias);
+ #endif /* CONFIG_ACS */
++ os_free(conf->edcca_threshold);
+ wpabuf_free(conf->lci);
+ wpabuf_free(conf->civic);
+
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 3f68e76..775c567 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1153,8 +1153,37 @@ struct hostapd_config {
+ #define CH_SWITCH_EHT_ENABLED BIT(0)
+ #define CH_SWITCH_EHT_DISABLED BIT(1)
+ unsigned int ch_switch_eht_config;
++ u8 edcca_enable;
++ s8 edcca_compensation;
++ int *edcca_threshold;
+ };
+
++enum edcca_mode {
++ EDCCA_MODE_FORCE_DISABLE = 0,
++ EDCCA_MODE_AUTO = 1,
++};
++
++enum edcca_bw_id {
++ EDCCA_BW_20 = 0,
++ EDCCA_BW_40,
++ EDCCA_BW_80,
++ EDCCA_MAX_BW_NUM,
++};
++
++enum mtk_vendor_attr_edcca_ctrl_mode {
++ EDCCA_CTRL_SET_EN = 0,
++ EDCCA_CTRL_SET_THRES,
++ EDCCA_CTRL_GET_EN,
++ EDCCA_CTRL_GET_THRES,
++ EDCCA_CTRL_NUM,
++};
++
++#define EDCCA_DEFAULT_COMPENSATION -6
++#define EDCCA_MIN_COMPENSATION -126
++#define EDCCA_MAX_COMPENSATION 126
++#define EDCCA_MIN_CONFIG_THRES -126
++#define EDCCA_MAX_CONFIG_THRES 0
++
+
+ static inline enum oper_chan_width
+ hostapd_get_oper_chwidth(struct hostapd_config *conf)
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 0c7aee2..25e967d 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1015,3 +1015,27 @@ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable)
+ return 0;
+ return hapd->driver->dpp_listen(hapd->drv_priv, enable);
+ }
++
++int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->configure_edcca_enable)
++ return 0;
++ return hapd->driver->configure_edcca_enable(hapd->drv_priv,
++ hapd->iconf->edcca_enable,
++ hapd->iconf->edcca_compensation);
++}
++
++int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
++ const int *threshold)
++{
++ if (!hapd->driver || !hapd->driver->configure_edcca_threshold)
++ return 0;
++ return hapd->driver->configure_edcca_threshold(hapd->drv_priv, threshold);
++}
++
++int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
++{
++ if (!hapd->driver || !hapd->driver->get_edcca)
++ return 0;
++ return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index b4fb766..70a99f4 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -138,7 +138,10 @@ int hostapd_drv_do_acs(struct hostapd_data *hapd);
+ int hostapd_drv_update_dh_ie(struct hostapd_data *hapd, const u8 *peer,
+ u16 reason_code, const u8 *ie, size_t ielen);
+ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable);
+-
++int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
++int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
++ const int *threshold);
++int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 0dd8c13..d05f948 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2295,6 +2295,13 @@ dfs_offload:
+ }
+ #endif /* CONFIG_MESH */
+
++ if (hostapd_drv_configure_edcca_enable(hapd) < 0)
++ goto fail;
++
++ if (hostapd_drv_configure_edcca_threshold(hapd,
++ hapd->iconf->edcca_threshold) < 0)
++ goto fail;
++
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+ if (iface->interfaces && iface->interfaces->terminate_on_error > 0)
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 528387f..7056126 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -29,14 +29,21 @@ enum mtk_vendor_attr_edcca_ctrl {
+ NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
+ };
+
+-enum mtk_vendor_attr_edcca_ctrl_mode {
+- EDCCA_CTRL_SET_EN = 0,
+- EDCCA_CTRL_SET_THERS,
+- EDCCA_CTRL_GET_EN,
+- EDCCA_CTRL_GET_THERS,
+- EDCCA_CTRL_NUM,
++enum mtk_vendor_attr_edcca_dump {
++ MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
++
++ MTK_VENDOR_ATTR_EDCCA_DUMP_MODE,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP,
++ MTK_VENDOR_ATTR_EDCCA_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
+ };
+
++
+ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+ [MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
+ [MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 1d2b1b2..3559974 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4676,6 +4676,10 @@ struct wpa_driver_ops {
+ const u8 *match, size_t match_len,
+ bool multicast);
+ #endif /* CONFIG_TESTING_OPTIONS */
++ int (*configure_edcca_enable)(void *priv, const u8 edcca_enable,
++ const s8 edcca_compensation);
++ int (*configure_edcca_threshold)(void *priv, const int *threshold);
++ int (*get_edcca)(void *priv, const u8 mode, u8 *value);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 5eba0ea..9c2782c 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -35,6 +35,8 @@
+ #include "radiotap_iter.h"
+ #include "rfkill.h"
+ #include "driver_nl80211.h"
++#include "common/mtk_vendor.h"
++#include "ap/ap_config.h"
+
+
+ #ifndef NETLINK_CAP_ACK
+@@ -12368,6 +12370,165 @@ static int testing_nl80211_radio_disable(void *priv, int disabled)
+
+ #endif /* CONFIG_TESTING_OPTIONS */
+
++static int nl80211_configure_edcca_enable(void *priv,
++ const u8 edcca_enable,
++ const s8 edcca_compensation)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_edcca_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting EDCCA enable");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, EDCCA_CTRL_SET_EN) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL, edcca_enable) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
++ edcca_compensation)) {
++ wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to configure EDCCA enable. ret=%d (%s) ",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
++
++static int nl80211_configure_edcca_threshold(void *priv, const int *threshold)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_edcca_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting EDCCA threshold");
++ return 0;
++ }
++
++ if (!threshold) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Input EDCCA threshold is empty!");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, EDCCA_CTRL_SET_THRES) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL, threshold[0] & 0xff) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL, threshold[1] & 0xff) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL, threshold[2] & 0xff)) {
++ wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to configure EDCCA threshold. ret=%d (%s) ",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
++
++
++static int edcca_info_handler(struct nl_msg *msg, void *arg)
++{
++ u8 *info = (u8*) arg;
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_MAX + 1];
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct nlattr *nl_vend, *attr;
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!nl_vend)
++ return NL_SKIP;
++
++ nla_parse(tb_vendor, MTK_VENDOR_ATTR_EDCCA_DUMP_MAX,
++ nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL");
++ return NL_SKIP;
++ }
++
++ *info++ = nla_get_u8(attr);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL");
++ return NL_SKIP;
++ }
++
++ *info++ = nla_get_u8(attr);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL");
++ return NL_SKIP;
++ }
++
++ *info = nla_get_u8(attr);
++ return NL_SKIP;
++}
++
++
++static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_edcca_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting EDCCA threshold");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, mode)) {
++ wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, edcca_info_handler, value, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to get EDCCA configuration. ret=%d (%s)",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
++
+
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+@@ -12514,4 +12675,8 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .register_frame = testing_nl80211_register_frame,
+ .radio_disable = testing_nl80211_radio_disable,
+ #endif /* CONFIG_TESTING_OPTIONS */
++/* Need ifdef CONFIG_DRIVER_NL80211_MTK */
++ .configure_edcca_enable = nl80211_configure_edcca_enable,
++ .configure_edcca_threshold = nl80211_configure_edcca_threshold,
++ .get_edcca = nl80211_get_edcca,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 6e40d55..13e5d24 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -181,6 +181,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int qca_do_acs:1;
+ unsigned int brcm_do_acs:1;
+ unsigned int uses_6ghz:1;
++ unsigned int mtk_edcca_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 7ede0d0..732ae29 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -18,6 +18,7 @@
+ #include "common/qca-vendor-attr.h"
+ #include "common/brcm_vendor.h"
+ #include "driver_nl80211.h"
++#include "common/mtk_vendor.h"
+
+
+ static int protocol_feature_handler(struct nl_msg *msg, void *arg)
+@@ -1050,6 +1051,12 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ break;
+ }
+ #endif /* CONFIG_DRIVER_NL80211_BRCM */
++ } else if (vinfo->vendor_id == OUI_MTK) {
++ switch (vinfo->subcmd) {
++ case MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL :
++ drv->mtk_edcca_vendor_cmd_avail = 1;
++ break;
++ }
+ }
+
+ wpa_printf(MSG_DEBUG, "nl80211: Supported vendor command: vendor_id=0x%x subcmd=%u",
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
new file mode 100644
index 0000000..18617be
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
@@ -0,0 +1,450 @@
+From a288f97e708bc579e285b509f7c0655c2f27a76c Mon Sep 17 00:00:00 2001
+From: TomLiu <tomml.liu@mediatek.com>
+Date: Tue, 9 Aug 2022 10:23:44 -0700
+Subject: [PATCH 99905/99909] hostapd: mtk: Add hostapd HEMU SET/GET control
+
+---
+ hostapd/config_file.c | 9 +++
+ hostapd/ctrl_iface.c | 62 +++++++++++++++++
+ hostapd/hostapd_cli.c | 18 +++++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 1 +
+ src/ap/ap_drv_ops.c | 14 ++++
+ src/ap/ap_drv_ops.h | 2 +
+ src/ap/hostapd.c | 2 +
+ src/common/mtk_vendor.h | 15 ++++
+ src/drivers/driver.h | 13 ++++
+ src/drivers/driver_nl80211.c | 110 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 3 +
+ 13 files changed, 251 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 0ee8952..b22d10b 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3659,6 +3659,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ return 1;
+ }
+ bss->unsol_bcast_probe_resp_interval = val;
++ } else if (os_strcmp(buf, "hemu_onoff") == 0) {
++ int val = atoi(pos);
++ if (val < 0 || val > 15) {
++ wpa_printf(MSG_ERROR,
++ "Line %d: invalid hemu_onoff value",
++ line);
++ return 1;
++ }
++ conf->hemu_onoff = val;
+ #endif /* CONFIG_IEEE80211AX */
+ } else if (os_strcmp(buf, "max_listen_interval") == 0) {
+ bss->max_listen_interval = atoi(pos);
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 9c70d54..5f71aee 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3441,6 +3441,63 @@ hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
+ }
+
+
++static int
++hostapd_ctrl_iface_set_hemu(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *pos, *config, *value;
++ config = cmd;
++ pos = os_strchr(config, ' ');
++ if (pos == NULL)
++ return -1;
++ *pos++ = '\0';
++
++ if(pos == NULL)
++ return -1;
++ value = pos;
++
++ if (os_strcmp(config, "onoff") == 0) {
++ int hemu = atoi(value);
++ if (hemu < 0 || hemu > 15) {
++ wpa_printf(MSG_ERROR, "Invalid value for hemu");
++ return -1;
++ }
++ hapd->iconf->hemu_onoff = (u8) hemu;
++ } else {
++ wpa_printf(MSG_ERROR,
++ "Unsupported parameter %s for SET_HEMU", config);
++ return -1;
++ }
++
++ if(hostapd_drv_hemu_ctrl(hapd) == 0) {
++ return os_snprintf(buf, buflen, "OK\n");
++ } else {
++ return -1;
++ }
++}
++
++
++static int
++hostapd_ctrl_iface_get_hemu(struct hostapd_data *hapd, char *buf,
++ size_t buflen)
++{
++ u8 hemu_onoff;
++ char *pos, *end;
++
++ pos = buf;
++ end = buf + buflen;
++
++ if (hostapd_drv_hemu_dump(hapd, &hemu_onoff) == 0) {
++ hapd->iconf->hemu_onoff = hemu_onoff;
++ return os_snprintf(pos, end - pos, "[hostapd_cli] = UL MU-MIMO: %d, DL MU-MIMO: %d, UL OFDMA: %d, DL OFDMA: %d\n",
++ !!(hemu_onoff&BIT(3)), !!(hemu_onoff&BIT(2)), !!(hemu_onoff&BIT(1)), !!(hemu_onoff&BIT(0)));
++ } else {
++ wpa_printf(MSG_INFO, "ctrl iface failed to call");
++ return -1;
++ }
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -3993,6 +4050,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ } else if (os_strncmp(buf, "GET_EDCCA ", 10) == 0) {
+ reply_len = hostapd_ctrl_iface_get_edcca(hapd, buf+10, reply,
+ reply_size);
++ } else if (os_strncmp(buf, "SET_HEMU ", 9) == 0) {
++ reply_len = hostapd_ctrl_iface_set_hemu(hapd, buf+9, reply,
++ reply_size);
++ } else if (os_strncmp(buf, "GET_HEMU", 8) == 0) {
++ reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index db21258..0d36477 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1380,6 +1380,20 @@ static int hostapd_cli_cmd_driver_flags(struct wpa_ctrl *ctrl, int argc,
+ }
+
+
++static int hostapd_cli_cmd_set_hemu(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "SET_HEMU", 1, argc, argv);
++}
++
++
++static int hostapd_cli_cmd_get_hemu(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "GET_HEMU", 0, NULL, NULL);
++}
++
++
+ #ifdef CONFIG_DPP
+
+ static int hostapd_cli_cmd_dpp_qr_code(struct wpa_ctrl *ctrl, int argc,
+@@ -1705,6 +1719,10 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ " = send FTM range request"},
+ { "driver_flags", hostapd_cli_cmd_driver_flags, NULL,
+ " = show supported driver flags"},
++ { "set_hemu", hostapd_cli_cmd_set_hemu, NULL,
++ "<value> [0-15] bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0)"},
++ { "get_hemu", hostapd_cli_cmd_get_hemu, NULL,
++ " = show hemu onoff value in 0-15 bitmap"},
+ #ifdef CONFIG_DPP
+ { "dpp_qr_code", hostapd_cli_cmd_dpp_qr_code, NULL,
+ "report a scanned DPP URI from a QR Code" },
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 344585a..0e1f192 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -280,6 +280,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ conf->he_6ghz_max_ampdu_len_exp = 7;
+ conf->he_6ghz_rx_ant_pat = 1;
+ conf->he_6ghz_tx_ant_pat = 1;
++ conf->hemu_onoff = 13;
+ #endif /* CONFIG_IEEE80211AX */
+
+ /* The third octet of the country string uses an ASCII space character
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 775c567..41b8c68 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1114,6 +1114,7 @@ struct hostapd_config {
+ u8 he_6ghz_rx_ant_pat;
+ u8 he_6ghz_tx_ant_pat;
+ u8 he_6ghz_reg_pwr_type;
++ u8 hemu_onoff;
+ #endif /* CONFIG_IEEE80211AX */
+
+ /* VHT enable/disable config from CHAN_SWITCH */
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 25e967d..4598737 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1039,3 +1039,17 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
+ return 0;
+ return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
+ }
++
++int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->hemu_ctrl)
++ return 0;
++ return hapd->driver->hemu_ctrl(hapd->drv_priv, hapd->iconf->hemu_onoff);
++}
++
++int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
++{
++ if (!hapd->driver || !hapd->driver->hemu_dump)
++ return 0;
++ return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 70a99f4..bca39c5 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -142,6 +142,8 @@ int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
+ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
+ const int *threshold);
+ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
++int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index d05f948..921769d 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2301,6 +2301,8 @@ dfs_offload:
+ if (hostapd_drv_configure_edcca_threshold(hapd,
+ hapd->iconf->edcca_threshold) < 0)
+ goto fail;
++ if (hostapd_drv_hemu_ctrl(hapd) < 0)
++ goto fail;
+
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 7056126..69a46df 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -10,6 +10,8 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
+ MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
+ MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
++ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
+ };
+
+@@ -174,6 +176,19 @@ enum mtk_vendor_attr_rfeature_ctrl {
+ NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
+ };
+
++enum mtk_vendor_attr_hemu_ctrl {
++ MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
++ MTK_VENDOR_ATTR_HEMU_CTRL_DUMP,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
++ MTK_VENDOR_ATTR_HEMU_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
++};
++
++
+ #define CSI_MAX_COUNT 256
+ #define ETH_ALEN 6
+
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 3559974..4cd7505 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1623,6 +1623,11 @@ struct wpa_driver_ap_params {
+ * Unsolicited broadcast Probe Response template length
+ */
+ size_t unsol_bcast_probe_resp_tmpl_len;
++
++ /**
++ * hemu onoff=<val> (bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0))
++ */
++ u8 hemu_onoff;
+ };
+
+ struct wpa_driver_mesh_bss_params {
+@@ -4680,6 +4685,14 @@ struct wpa_driver_ops {
+ const s8 edcca_compensation);
+ int (*configure_edcca_threshold)(void *priv, const int *threshold);
+ int (*get_edcca)(void *priv, const u8 mode, u8 *value);
++
++ /**
++ * hemu_ctrl - ctrl on off for UL/DL MURU
++ * @priv: Private driver interface data
++ *
++ */
++ int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
++ int (*hemu_dump)(void *priv, u8 *hemu_onoff);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 9c2782c..73dee2e 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12304,6 +12304,114 @@ fail:
+ }
+
+
++#ifdef CONFIG_IEEE80211AX
++static int nl80211_hemu_muruonoff(void *priv, u8 hemu_onoff)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_hemu_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting hemu control");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF, hemu_onoff)) {
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if(ret){
++ wpa_printf(MSG_ERROR, "Failed to set hemu_onoff. ret=%d (%s)", ret, strerror(-ret));
++ }
++ return ret;
++}
++
++
++static int hemu_dump_handler(struct nl_msg *msg, void *arg)
++{
++ u8 *hemu_onoff = (u8 *) arg;
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb_vendor[MTK_VENDOR_ATTR_HEMU_CTRL_MAX + 1];
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct nlattr *nl_vend, *attr;
++
++ static const struct nla_policy
++ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL + 1] = {
++ [MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_HEMU_CTRL_DUMP] = {.type = NLA_U8 },
++ };
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!nl_vend)
++ return NL_SKIP;
++
++ nla_parse(tb_vendor, MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
++ nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: cannot find MTK_VENDOR_ATTR_HEMU_CTRL_DUMP");
++ return NL_SKIP;
++ }
++
++ *hemu_onoff = nla_get_u8(attr);
++ wpa_printf(MSG_DEBUG, "nla_get hemu_onoff: %d\n", *hemu_onoff);
++
++ return 0;
++}
++
++static int nl80211_hemu_dump(void *priv, u8 *hemu_onoff)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *attr;
++ int ret;
++
++ if (!drv->mtk_hemu_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting hemu control");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL)) {
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++
++ attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++ if (!attr) {
++ nlmsg_free(msg);
++ return -1;
++ }
++
++ nla_nest_end(msg, attr);
++
++ ret = send_and_recv_msgs(drv, msg, hemu_dump_handler, hemu_onoff, NULL, NULL);
++
++ if(ret){
++ wpa_printf(MSG_ERROR, "Failed to get hemu_onoff. ret=%d (%s)", ret, strerror(-ret));
++ }
++
++ return ret;
++}
++#endif /* CONFIG_IEEE80211AX */
++
++
+ #ifdef CONFIG_DPP
+ static int nl80211_dpp_listen(void *priv, bool enable)
+ {
+@@ -12668,6 +12776,8 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .update_connect_params = nl80211_update_connection_params,
+ .send_external_auth_status = nl80211_send_external_auth_status,
+ .set_4addr_mode = nl80211_set_4addr_mode,
++ .hemu_ctrl = nl80211_hemu_muruonoff,
++ .hemu_dump = nl80211_hemu_dump,
+ #ifdef CONFIG_DPP
+ .dpp_listen = nl80211_dpp_listen,
+ #endif /* CONFIG_DPP */
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 13e5d24..57f0249 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -182,6 +182,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int brcm_do_acs:1;
+ unsigned int uses_6ghz:1;
+ unsigned int mtk_edcca_vendor_cmd_avail:1;
++ unsigned int mtk_hemu_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 732ae29..cc146d9 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1056,6 +1056,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ case MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL :
+ drv->mtk_edcca_vendor_cmd_avail = 1;
+ break;
++ case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
++ drv->mtk_hemu_vendor_cmd_avail = 1;
++ break;
+ }
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
new file mode 100644
index 0000000..fc81ed1
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
@@ -0,0 +1,247 @@
+From 26c6be11e7597490ccc4d7704542c78dec6c4cd1 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 2 Sep 2022 01:03:23 +0800
+Subject: [PATCH 99906/99909] hostapd: mtk: Add three wire PTA ctrl hostapd
+ vendor command
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c | 4 ++++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 13 ++++++++++++
+ src/ap/ap_drv_ops.c | 11 +++++++++++
+ src/ap/ap_drv_ops.h | 1 +
+ src/ap/hostapd.c | 2 ++
+ src/common/mtk_vendor.h | 16 +++++++++++++++
+ src/drivers/driver.h | 8 ++++++++
+ src/drivers/driver_nl80211.c | 33 +++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 3 +++
+ 11 files changed, 93 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index b22d10b..18b372a 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4794,6 +4794,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ return 1;
+ }
+ conf->edcca_compensation = (s8) val;
++ } else if (os_strcmp(buf, "three_wire_enable") == 0) {
++ u8 en = atoi(pos);
++
++ conf->three_wire_enable = en;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 0e1f192..9249a6b 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -297,6 +297,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+
+ conf->edcca_enable = EDCCA_MODE_AUTO;
+ conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
++ conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
+
+ return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 41b8c68..71cf515 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1157,6 +1157,19 @@ struct hostapd_config {
+ u8 edcca_enable;
+ s8 edcca_compensation;
+ int *edcca_threshold;
++ u8 three_wire_enable;
++};
++
++enum three_wire_mode {
++ THREE_WIRE_MODE_DISABLE,
++ THREE_WIRE_MODE_EXT0_ENABLE,
++ THREE_WIRE_MODE_EXT1_ENABLE,
++ THREE_WIRE_MODE_ALL_ENABLE,
++
++ /* keep last */
++ NUM_THREE_WIRE_MODE,
++ THREE_WIRE_MODE_MAX =
++ NUM_THREE_WIRE_MODE - 1
+ };
+
+ enum edcca_mode {
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 4598737..a1d83e4 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1053,3 +1053,14 @@ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
+ return 0;
+ return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
+ }
++
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->three_wire_ctrl)
++ return 0;
++ if (hapd->iconf->three_wire_enable > THREE_WIRE_MODE_MAX) {
++ wpa_printf(MSG_INFO, "Invalid value for three wire enable\n");
++ return 0;
++ }
++ return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index bca39c5..5ba6297 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -144,6 +144,7 @@ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
+ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+ int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 921769d..f9dabdf 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2303,6 +2303,8 @@ dfs_offload:
+ goto fail;
+ if (hostapd_drv_hemu_ctrl(hapd) < 0)
+ goto fail;
++ if (hostapd_drv_three_wire_ctrl(hapd) < 0)
++ goto fail;
+
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 69a46df..ee5a4f4 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++ MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
+ };
+
+ enum mtk_vendor_attr_edcca_ctrl {
+@@ -55,6 +56,21 @@ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+ [MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
+ };
+
++enum mtk_vendor_attr_3wire_ctrl {
++ MTK_VENDOR_ATTR_3WIRE_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_3WIRE_CTRL_MODE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL,
++ MTK_VENDOR_ATTR_3WIRE_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL - 1
++};
++
++static struct nla_policy three_wire_ctrl_policy[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL] = {
++ [MTK_VENDOR_ATTR_3WIRE_CTRL_MODE] = {.type = NLA_U8 },
++};
++
+ enum mtk_vendor_attr_csi_ctrl {
+ MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
+
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 4cd7505..9ca19af 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4693,6 +4693,14 @@ struct wpa_driver_ops {
+ */
+ int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
+ int (*hemu_dump)(void *priv, u8 *hemu_onoff);
++
++ /**
++ * three_wire_ctrl - set three_wire_ctrl mode
++ * @priv: Private driver interface data
++ * @three_wire_enable: three_wire_ctrl mode
++ *
++ */
++ int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 73dee2e..2bb8cc2 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12637,6 +12637,38 @@ static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
+ return ret;
+ }
+
++static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ /* Prepare nl80211 cmd */
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_3wire_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting three wire control");
++ return 0;
++ }
++
++ if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL) ||
++ !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++ nla_put_u8(msg, MTK_VENDOR_ATTR_3WIRE_CTRL_MODE, three_wire_enable)) {
++ nlmsg_free(msg);
++ return -ENOBUFS;
++ }
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to enable three wire. ret=%d (%s) ",
++ ret, strerror(-ret));
++ }
++ return ret;
++}
+
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+@@ -12789,4 +12821,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .configure_edcca_enable = nl80211_configure_edcca_enable,
+ .configure_edcca_threshold = nl80211_configure_edcca_threshold,
+ .get_edcca = nl80211_get_edcca,
++ .three_wire_ctrl = nl80211_enable_three_wire,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 57f0249..9fe7811 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -183,6 +183,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int uses_6ghz:1;
+ unsigned int mtk_edcca_vendor_cmd_avail:1;
+ unsigned int mtk_hemu_vendor_cmd_avail:1;
++ unsigned int mtk_3wire_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index cc146d9..04bc54e 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1059,6 +1059,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
+ drv->mtk_hemu_vendor_cmd_avail = 1;
+ break;
++ case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
++ drv->mtk_3wire_vendor_cmd_avail = 1;
++ break;
+ }
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99907-hostapd-mtk-Add-hostapd-iBF-control.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
new file mode 100644
index 0000000..50a08ba
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
@@ -0,0 +1,431 @@
+From 1f60afd21c6dd7dfe3d504dee7507654a981033b Mon Sep 17 00:00:00 2001
+From: mtk27835 <shurong.wen@mediatek.com>
+Date: Wed, 7 Sep 2022 14:41:51 -0700
+Subject: [PATCH 99907/99909] hostapd: mtk: Add hostapd iBF control
+
+Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
+---
+ hostapd/config_file.c | 3 +
+ hostapd/ctrl_iface.c | 26 +++++++
+ hostapd/hostapd_cli.c | 9 +++
+ src/ap/ap_config.c | 1 +
+ src/ap/ap_config.h | 2 +
+ src/ap/ap_drv_ops.c | 14 ++++
+ src/ap/ap_drv_ops.h | 2 +
+ src/ap/hostapd.c | 2 +
+ src/common/mtk_vendor.h | 35 +++++++++-
+ src/drivers/driver.h | 19 ++++++
+ src/drivers/driver_nl80211.c | 108 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 3 +
+ 13 files changed, 224 insertions(+), 1 deletion(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 18b372a..d9d882c 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4798,6 +4798,9 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ u8 en = atoi(pos);
+
+ conf->three_wire_enable = en;
++ } else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
++ int val = atoi(pos);
++ conf->ibf_enable = !!val;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 5f71aee..c881d37 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3498,6 +3498,30 @@ hostapd_ctrl_iface_get_hemu(struct hostapd_data *hapd, char *buf,
+ }
+
+
++static int
++hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
++ size_t buflen)
++{
++ u8 ibf_enable;
++ int ret;
++ char *pos, *end;
++
++ pos = buf;
++ end = buf + buflen;
++
++ if (hostapd_drv_ibf_dump(hapd, &ibf_enable) == 0) {
++ hapd->iconf->ibf_enable = ibf_enable;
++ ret = os_snprintf(pos, end - pos, "ibf_enable: %u\n",
++ ibf_enable);
++ }
++
++ if (os_snprintf_error(end - pos, ret))
++ return 0;
++
++ return ret;
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -4055,6 +4079,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_size);
+ } else if (os_strncmp(buf, "GET_HEMU", 8) == 0) {
+ reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
++ } else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
++ reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 0d36477..c2a123a 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1586,6 +1586,13 @@ static int hostapd_cli_cmd_driver(struct wpa_ctrl *ctrl, int argc, char *argv[])
+ #endif /* ANDROID */
+
+
++static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "GET_IBF", 0, NULL, NULL);
++}
++
++
+ struct hostapd_cli_cmd {
+ const char *cmd;
+ int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
+@@ -1787,6 +1794,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ #endif /* ANDROID */
+ { "inband_discovery", hostapd_cli_cmd_inband_discovery, NULL,
+ "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
++ { "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
++ " = show iBF state (enabled/disabled)"},
+ { NULL, NULL, NULL, NULL }
+ };
+
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 9249a6b..7a96cb8 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -298,6 +298,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ conf->edcca_enable = EDCCA_MODE_AUTO;
+ conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
+ conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
++ conf->ibf_enable = IBF_DEFAULT_ENABLE;
+
+ return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 71cf515..44a0e7e 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1158,6 +1158,7 @@ struct hostapd_config {
+ s8 edcca_compensation;
+ int *edcca_threshold;
+ u8 three_wire_enable;
++ u8 ibf_enable;
+ };
+
+ enum three_wire_mode {
+@@ -1198,6 +1199,7 @@ enum mtk_vendor_attr_edcca_ctrl_mode {
+ #define EDCCA_MIN_CONFIG_THRES -126
+ #define EDCCA_MAX_CONFIG_THRES 0
+
++#define IBF_DEFAULT_ENABLE 0
+
+ static inline enum oper_chan_width
+ hostapd_get_oper_chwidth(struct hostapd_config *conf)
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index a1d83e4..60ae825 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1064,3 +1064,17 @@ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
+ }
+ return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
+ }
++
++int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd)
++{
++ if (!hapd->driver || !hapd->driver->ibf_ctrl)
++ return 0;
++ return hapd->driver->ibf_ctrl(hapd->drv_priv, hapd->iconf->ibf_enable);
++}
++
++int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
++{
++ if (!hapd->driver || !hapd->driver->ibf_dump)
++ return 0;
++ return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
++}
+\ No newline at end of file
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 5ba6297..ab9aedc 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -145,6 +145,8 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+ int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
+
+ #include "drivers/driver.h"
+
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index f9dabdf..e44b73d 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2305,6 +2305,8 @@ dfs_offload:
+ goto fail;
+ if (hostapd_drv_three_wire_ctrl(hapd) < 0)
+ goto fail;
++ if (hostapd_drv_ibf_ctrl(hapd) < 0)
++ goto fail;
+
+ wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index ee5a4f4..4050cf8 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -13,7 +13,8 @@ enum mtk_nl80211_vendor_subcmds {
+ MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
+- MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
++ MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
++ MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
+ };
+
+ enum mtk_vendor_attr_edcca_ctrl {
+@@ -204,6 +205,38 @@ enum mtk_vendor_attr_hemu_ctrl {
+ NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
+ };
+
++enum mtk_vendor_attr_ibf_ctrl {
++ MTK_VENDOR_ATTR_IBF_CTRL_UNSPEC,
++
++ MTK_VENDOR_ATTR_IBF_CTRL_ENABLE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_IBF_CTRL,
++ MTK_VENDOR_ATTR_IBF_CTRL_MAX =
++ NUM_MTK_VENDOR_ATTRS_IBF_CTRL - 1
++};
++
++enum mtk_vendor_attr_ibf_dump {
++ MTK_VENDOR_ATTR_IBF_DUMP_UNSPEC,
++
++ MTK_VENDOR_ATTR_IBF_DUMP_ENABLE,
++
++ /* keep last */
++ NUM_MTK_VENDOR_ATTRS_IBF_DUMP,
++ MTK_VENDOR_ATTR_IBF_DUMP_MAX =
++ NUM_MTK_VENDOR_ATTRS_IBF_DUMP - 1
++};
++
++static struct nla_policy
++ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
++ [MTK_VENDOR_ATTR_IBF_CTRL_ENABLE] = { .type = NLA_U8 },
++};
++
++static struct nla_policy
++ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
++ [MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
++};
++
+
+ #define CSI_MAX_COUNT 256
+ #define ETH_ALEN 6
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 9ca19af..71ded61 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1628,6 +1628,11 @@ struct wpa_driver_ap_params {
+ * hemu onoff=<val> (bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0))
+ */
+ u8 hemu_onoff;
++
++ /**
++ * ibf_enable=<val>
++ */
++ u8 ibf_enable;
+ };
+
+ struct wpa_driver_mesh_bss_params {
+@@ -4701,6 +4706,20 @@ struct wpa_driver_ops {
+ *
+ */
+ int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
++
++ /**
++ * ibf_ctrl - ctrl disable/enable for ibf
++ * @priv: Private driver interface data
++ *
++ */
++ int (*ibf_ctrl)(void *priv, u8 ibf_enable);
++
++ /**
++ * ibf_dump - dump ibf
++ * @priv: Private driver interface data
++ *
++ */
++ int (*ibf_dump)(void *priv, u8 *ibf_enable);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 2bb8cc2..e974f85 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12670,6 +12670,112 @@ static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
+ return ret;
+ }
+
++static int nl80211_ibf_enable(void *priv, u8 ibf_enable)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ if (!drv->mtk_ibf_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support setting ibf control");
++ return 0;
++ }
++
++ msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++ if (!data)
++ goto fail;
++
++ nla_put_u8(msg, MTK_VENDOR_ATTR_IBF_CTRL_ENABLE, ibf_enable);
++
++ nla_nest_end(msg, data);
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to set ibf_enable. ret=%d (%s)", ret, strerror(-ret));
++ }
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++}
++
++static int ibf_dump_handler(struct nl_msg *msg, void *arg)
++{
++ u8 *ibf_enable = (u8 *) arg;
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb_vendor[MTK_VENDOR_ATTR_IBF_DUMP_MAX + 1];
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct nlattr *nl_vend, *attr;
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!nl_vend)
++ return NL_SKIP;
++
++ nla_parse(tb_vendor, MTK_VENDOR_ATTR_IBF_DUMP_MAX,
++ nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++ attr = tb_vendor[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE];
++ if (!attr) {
++ wpa_printf(MSG_ERROR, "nl80211: cannot find MTK_VENDOR_ATTR_IBF_DUMP_ENABLE");
++ return NL_SKIP;
++ }
++
++ *ibf_enable = nla_get_u8(attr);
++
++ return NL_SKIP;
++}
++
++static int
++nl80211_ibf_dump(void *priv, u8 *ibf_enable)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
++ if (!data)
++ goto fail;
++
++ nla_nest_end(msg, data);
++
++ ret = send_and_recv_msgs(drv, msg, ibf_dump_handler, ibf_enable, NULL, NULL);
++
++ if (ret) {
++ wpa_printf(MSG_ERROR, "Failed to dump ibf_enable. ret=%d (%s)", ret, strerror(-ret));
++ }
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+ .desc = "Linux nl80211/cfg80211",
+@@ -12822,4 +12928,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .configure_edcca_threshold = nl80211_configure_edcca_threshold,
+ .get_edcca = nl80211_get_edcca,
+ .three_wire_ctrl = nl80211_enable_three_wire,
++ .ibf_ctrl = nl80211_ibf_enable,
++ .ibf_dump = nl80211_ibf_dump,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 9fe7811..607592c 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -184,6 +184,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int mtk_edcca_vendor_cmd_avail:1;
+ unsigned int mtk_hemu_vendor_cmd_avail:1;
+ unsigned int mtk_3wire_vendor_cmd_avail:1;
++ unsigned int mtk_ibf_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 04bc54e..9ecc0ff 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1062,6 +1062,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
+ drv->mtk_3wire_vendor_cmd_avail = 1;
+ break;
++ case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
++ drv->mtk_ibf_vendor_cmd_avail = 1;
++ break;
+ }
+ }
+
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
new file mode 100644
index 0000000..9b96d98
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
@@ -0,0 +1,27 @@
+From 28228a96980512f30c8c8aac0f819c36f7241b68 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 22 Sep 2022 16:08:09 +0800
+Subject: [PATCH 99908/99909] hostapd: mtk: Do not include HE capab IE if
+ associated sta's HE capab IE is invalid
+
+---
+ src/ap/ieee802_11.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
+index d921783..098793e 100644
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -5192,7 +5192,8 @@ static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
+ #endif /* CONFIG_IEEE80211AC */
+
+ #ifdef CONFIG_IEEE80211AX
+- if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax) {
++ if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax &&
++ sta->flags & WLAN_STA_HE) {
+ p = hostapd_eid_he_capab(hapd, p, IEEE80211_MODE_AP);
+ p = hostapd_eid_he_operation(hapd, p);
+ p = hostapd_eid_cca(hapd, p);
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch b/recipes-wifi/wpa-supplicant/files/patches-2.11/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
new file mode 100644
index 0000000..8da9b5f
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
@@ -0,0 +1,376 @@
+From 737d21c64ab0ac49e9cce7185f1f79bb0b71f50e Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 7 Oct 2022 10:46:29 +0800
+Subject: [PATCH 99909/99909] hostapd: mtk: Add DFS and ZWDFS support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c | 4 ++
+ hostapd/ctrl_iface.c | 95 ++++++++++++++++++++++++++++++++++++
+ src/ap/ap_config.h | 13 +++++
+ src/ap/dfs.c | 35 +++++++------
+ src/ap/dfs.h | 15 ++++++
+ src/ap/hostapd.c | 4 +-
+ src/drivers/driver.h | 7 +++
+ src/drivers/driver_nl80211.c | 29 +++++++++++
+ src/drivers/nl80211_copy.h | 1 +
+ 9 files changed, 186 insertions(+), 17 deletions(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index d9d882c..fd61448 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4801,6 +4801,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ } else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
+ int val = atoi(pos);
+ conf->ibf_enable = !!val;
++ } else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
++ u8 en = strtol(pos, NULL, 10);
++
++ conf->dfs_detect_mode = en;
+ } else {
+ wpa_printf(MSG_ERROR,
+ "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index c881d37..6ea1573 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3522,6 +3522,96 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
+ }
+
+
++static int
++hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
++ char *buf, size_t buflen)
++{
++ u8 dfs_detect_mode;
++
++ if (!value)
++ return -1;
++
++ dfs_detect_mode = strtol(value, NULL, 10);
++ if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
++ wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
++ return -1;
++ }
++ hapd->iconf->dfs_detect_mode = dfs_detect_mode;
++
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++
++static int
++hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ struct hostapd_iface *iface = hapd->iface;
++ char *pos, *param;
++ enum hostapd_hw_mode hw_mode;
++ bool chan_found = false;
++ int i, num_available_chandefs, channel, chan_width, sec = 0;
++ int sec_chan_idx_80p80 = -1;
++ u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
++ struct hostapd_channel_data *chan;
++ enum dfs_channel_type type = DFS_NO_CAC_YET;
++
++ param = os_strchr(cmd, ' ');
++ if (!param)
++ return -1;
++ *param++ = '\0';
++
++ pos = os_strstr(param, "chan=");
++ if (pos)
++ channel = strtol(pos + 5, NULL, 10);
++ else
++ return -1;
++
++ num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
++ for (i = 0; i < num_available_chandefs; i++) {
++ dfs_find_channel(iface, &chan, i, type);
++ if (chan->chan == channel) {
++ chan_found = true;
++ break;
++ }
++ }
++
++ if (!chan_found)
++ return -1;
++
++ if (iface->conf->secondary_channel)
++ sec = 1;
++
++ dfs_adjust_center_freq(iface, chan,
++ sec,
++ sec_chan_idx_80p80,
++ &oper_centr_freq_seg0_idx,
++ &oper_centr_freq_seg1_idx);
++
++ if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
++ chan->freq, chan->chan,
++ iface->conf->ieee80211n,
++ iface->conf->ieee80211ac,
++ iface->conf->ieee80211ax,
++ iface->conf->ieee80211be,
++ sec, hostapd_get_oper_chwidth(iface->conf),
++ oper_centr_freq_seg0_idx,
++ oper_centr_freq_seg1_idx, true)) {
++ wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
++ iface->radar_background.channel = -1;
++ return -1;
++ }
++
++ iface->radar_background.channel = chan->chan;
++ iface->radar_background.freq = chan->freq;
++ iface->radar_background.secondary_channel = sec;
++ iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
++ iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
++
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -4081,6 +4171,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ } else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
+ reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
++ } else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
++ reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
++ reply, reply_size);
++ } else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
++ reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 44a0e7e..3f5afdf 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1159,6 +1159,7 @@ struct hostapd_config {
+ int *edcca_threshold;
+ u8 three_wire_enable;
+ u8 ibf_enable;
++ u8 dfs_detect_mode;
+ };
+
+ enum three_wire_mode {
+@@ -1173,6 +1174,18 @@ enum three_wire_mode {
+ NUM_THREE_WIRE_MODE - 1
+ };
+
++enum dfs_mode {
++ DFS_DETECT_MODE_DISABLE,
++ DFS_DETECT_MODE_AP_ENABLE,
++ DFS_DETECT_MODE_BACKGROUND_ENABLE,
++ DFS_DETECT_MODE_ALL_ENABLE,
++
++ /* keep last */
++ NUM_DFS_DETECT_MODE,
++ DFS_DETECT_MODE_MAX =
++ NUM_DFS_DETECT_MODE - 1
++};
++
+ enum edcca_mode {
+ EDCCA_MODE_FORCE_DISABLE = 0,
+ EDCCA_MODE_AUTO = 1,
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index b5d105d..1c3f678 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -19,13 +19,6 @@
+ #include "dfs.h"
+ #include "crypto/crypto.h"
+
+-
+-enum dfs_channel_type {
+- DFS_ANY_CHANNEL,
+- DFS_AVAILABLE, /* non-radar or radar-available */
+- DFS_NO_CAC_YET, /* radar-not-yet-available */
+-};
+-
+ static struct hostapd_channel_data *
+ dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
+ u8 *oper_centr_freq_seg0_idx,
+@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
+ * - hapd->vht/he_oper_centr_freq_seg0_idx
+ * - hapd->vht/he_oper_centr_freq_seg1_idx
+ */
+-static int dfs_find_channel(struct hostapd_iface *iface,
+- struct hostapd_channel_data **ret_chan,
+- int idx, enum dfs_channel_type type)
++int dfs_find_channel(struct hostapd_iface *iface,
++ struct hostapd_channel_data **ret_chan,
++ int idx, enum dfs_channel_type type)
+ {
+ struct hostapd_hw_modes *mode;
+ struct hostapd_channel_data *chan;
+@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
+ }
+
+
+-static void dfs_adjust_center_freq(struct hostapd_iface *iface,
+- struct hostapd_channel_data *chan,
+- int secondary_channel,
+- int sec_chan_idx_80p80,
+- u8 *oper_centr_freq_seg0_idx,
+- u8 *oper_centr_freq_seg1_idx)
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++ struct hostapd_channel_data *chan,
++ int secondary_channel,
++ int sec_chan_idx_80p80,
++ u8 *oper_centr_freq_seg0_idx,
++ u8 *oper_centr_freq_seg1_idx)
+ {
+ if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
+ return;
+@@ -1317,6 +1310,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ __func__, iface->radar_background.cac_started ? "yes" : "no",
+ hostapd_csa_in_progress(iface) ? "yes" : "no");
+
++ /* Skip channel switch when background dfs detect mode is on */
++ if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
++ iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++ return 0;
++
+ /* Check if CSA in progress */
+ if (hostapd_csa_in_progress(iface))
+ return 0;
+@@ -1365,6 +1363,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
+ __func__, iface->cac_started ? "yes" : "no",
+ hostapd_csa_in_progress(iface) ? "yes" : "no");
+
++ /* Skip channel switch when dfs detect mode is on */
++ if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
++ iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++ return 0;
++
+ /* Check if CSA in progress */
+ if (hostapd_csa_in_progress(iface))
+ return 0;
+diff --git a/src/ap/dfs.h b/src/ap/dfs.h
+index 606c1b3..c2556d2 100644
+--- a/src/ap/dfs.h
++++ b/src/ap/dfs.h
+@@ -9,6 +9,12 @@
+ #ifndef DFS_H
+ #define DFS_H
+
++enum dfs_channel_type {
++ DFS_ANY_CHANNEL,
++ DFS_AVAILABLE, /* non-radar or radar-available */
++ DFS_NO_CAC_YET, /* radar-not-yet-available */
++};
++
+ int hostapd_handle_dfs(struct hostapd_iface *iface);
+
+ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+ int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
+ int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
+ int center_freq);
++int dfs_find_channel(struct hostapd_iface *iface,
++ struct hostapd_channel_data **ret_chan,
++ int idx, enum dfs_channel_type type);
++void dfs_adjust_center_freq(struct hostapd_iface *iface,
++ struct hostapd_channel_data *chan,
++ int secondary_channel,
++ int sec_chan_idx_80p80,
++ u8 *oper_centr_freq_seg0_idx,
++ u8 *oper_centr_freq_seg1_idx);
+
+ #endif /* DFS_H */
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index e44b73d..793ce2f 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -1463,7 +1463,9 @@ static int hostapd_setup_bss(struct hostapd_data *hapd, int first)
+ return -1;
+ }
+
+- if (!conf->start_disabled && ieee802_11_set_beacon(hapd) < 0)
++ if (conf->start_disabled)
++ hapd->driver->start_disabled(hapd->drv_priv);
++ else if (ieee802_11_set_beacon(hapd) < 0)
+ return -1;
+
+ if (flush_old_stations && !conf->start_disabled &&
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 71ded61..aa23fbd 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4720,6 +4720,13 @@ struct wpa_driver_ops {
+ *
+ */
+ int (*ibf_dump)(void *priv, u8 *ibf_enable);
++
++ /**
++ * start_disabled - set start_disabled to cfg80211
++ * @priv: Private driver interface data
++ *
++ */
++ int (*start_disabled)(void *priv);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index e974f85..003adc4 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12776,6 +12776,34 @@ fail:
+ return -ENOBUFS;
+ }
+
++static int nl80211_start_disabled(void *priv)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ int ret;
++
++ msg = nl80211_bss_msg(bss, 0, NL80211_CMD_NEW_BEACON);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_flag(msg, NL80211_ATTR_START_DISABLED))
++ goto fail;
++
++ ret = send_and_recv_msgs_connect_handle(drv, msg, bss, 1);
++
++ if (ret)
++ wpa_printf(MSG_ERROR, "Failed to set start_disabled. ret=%d (%s)",
++ ret, strerror(-ret));
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return ret;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+ .desc = "Linux nl80211/cfg80211",
+@@ -12930,4 +12958,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .three_wire_ctrl = nl80211_enable_three_wire,
+ .ibf_ctrl = nl80211_ibf_enable,
+ .ibf_dump = nl80211_ibf_dump,
++ .start_disabled = nl80211_start_disabled,
+ };
+diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
+index c4bf3ad..79bc76c 100644
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -3176,6 +3176,7 @@ enum nl80211_attrs {
+ NL80211_ATTR_EHT_CAPABILITY,
+
+ /* add attributes here, update the policy in nl80211.c */
++ NL80211_ATTR_START_DISABLED = 999,
+
+ __NL80211_ATTR_AFTER_LAST,
+ NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
+--
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.11/patches.inc b/recipes-wifi/wpa-supplicant/files/patches-2.11/patches.inc
new file mode 100644
index 0000000..388c3d7
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.11/patches.inc
@@ -0,0 +1,66 @@
+#patch patches (come from openwrt/lede/target/linux/mediatek)
+SRC_URI_append = " \
+ file://001-wolfssl-init-RNG-with-ECC-key.patch \
+ file://010-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch \
+ file://011-mesh-use-deterministic-channel-on-channel-switch.patch \
+ file://021-fix-sta-add-after-previous-connection.patch \
+ file://022-hostapd-fix-use-of-uninitialized-stack-variables.patch \
+ file://023-ndisc_snoop-call-dl_list_del-before-freeing-ipv6-add.patch \
+ file://030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch \
+ file://040-mesh-allow-processing-authentication-frames-in-block.patch \
+ file://050-build_fix.patch \
+ file://100-daemonize_fix.patch \
+ file://200-multicall.patch \
+ file://300-noscan.patch \
+ file://301-mesh-noscan.patch \
+ file://310-rescan_immediately.patch \
+ file://320-optional_rfkill.patch \
+ file://330-nl80211_fix_set_freq.patch \
+ file://340-reload_freq_change.patch \
+ file://341-mesh-ctrl-iface-channel-switch.patch \
+ file://350-nl80211_del_beacon_bss.patch \
+ file://360-ctrl_iface_reload.patch \
+ file://370-ap_sta_support.patch \
+ file://380-disable_ctrl_iface_mib.patch \
+ file://381-hostapd_cli_UNKNOWN-COMMAND.patch \
+ file://390-wpa_ie_cap_workaround.patch \
+ file://400-wps_single_auth_enc_type.patch \
+ file://410-limit_debug_messages.patch \
+ file://420-indicate-features.patch \
+ file://430-hostapd_cli_ifdef.patch \
+ file://431-wpa_cli_ifdef.patch \
+ file://432-missing-typedef.patch \
+ file://450-scan_wait.patch;apply=no \
+ file://460-wpa_supplicant-add-new-config-params-to-be-used-with.patch \
+ file://461-driver_nl80211-use-new-parameters-during-ibss-join.patch \
+ file://463-add-mcast_rate-to-11s.patch \
+ file://464-fix-mesh-obss-check.patch \
+ file://465-hostapd-config-support-random-BSS-color.patch \
+ file://470-survey_data_fallback.patch \
+ file://500-lto-jobserver-support.patch \
+ file://590-rrm-wnm-statistics.patch \
+ file://599-wpa_supplicant-fix-warnings.patch \
+ file://600-ubus_support.patch \
+ file://610-hostapd_cli_ujail_permission.patch \
+ file://700-wifi-reload.patch \
+ file://710-vlan_no_bridge.patch \
+ file://711-wds_bridge_force.patch \
+ file://720-iface_max_num_sta.patch \
+ file://730-ft_iface.patch \
+ file://740-snoop_iface.patch \
+ file://750-qos_map_set_without_interworking.patch \
+ file://751-qos_map_ignore_when_unsupported.patch \
+ file://800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch \
+ file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
+ file://992-openssl-include-rsa.patch \
+ file://99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch \
+ file://99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
+ file://99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch \
+ file://99903-hostapd-mtk-Add-mtk_vendor.h.patch \
+ file://99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch \
+ file://99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch \
+ file://99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch \
+ file://99907-hostapd-mtk-Add-hostapd-iBF-control.patch \
+ file://99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch \
+ file://99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch \
+ "
diff --git a/recipes-wifi/wpa-supplicant/wpa-supplicant_2.11.bb b/recipes-wifi/wpa-supplicant/wpa-supplicant_2.11.bb
new file mode 100644
index 0000000..d8ce220
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/wpa-supplicant_2.11.bb
@@ -0,0 +1,157 @@
+SUMMARY = "Client for Wi-Fi Protected Access (WPA)"
+DESCRIPTION = "wpa_supplicant is a WPA Supplicant for Linux, BSD, Mac OS X, and Windows with support for WPA and WPA2 (IEEE 802.11i / RSN). Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association of the wlan driver."
+HOMEPAGE = "http://w1.fi/wpa_supplicant/"
+BUGTRACKER = "http://w1.fi/security/"
+SECTION = "network"
+LICENSE = "BSD-3-Clause"
+LIC_FILES_CHKSUM = "file://hostapd/README;md5=c905478466c90f1cefc0df987c40e172"
+
+DEPENDS = "dbus libnl ubus"
+FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
+FILESEXTRAPATHS_prepend := "${THISDIR}/files/patches-${PV}:"
+
+SRCREV ?= "b704dc72ef824dfdd96674b90179b274d1d38105"
+SRC_URI = "git://w1.fi/hostap.git;protocol=https;branch=main \
+ file://wpa-supplicant.sh \
+ file://wpa_supplicant.conf \
+ file://wpa_supplicant.conf-sane \
+ file://99_wpa_supplicant \
+ file://wpa_supplicant-full.config \
+ file://src \
+ file://001-rdkb-remove-ubus-support.patch;apply=no \
+ "
+require files/patches-${PV}/patches.inc
+
+S = "${WORKDIR}/git"
+
+inherit pkgconfig systemd
+
+PACKAGECONFIG ?= "openssl"
+PACKAGECONFIG[openssl] = ",,openssl"
+
+CVE_PRODUCT = "wpa_supplicant"
+
+EXTRA_OEMAKE = "'LIBDIR=${libdir}' 'INCDIR=${includedir}' 'BINDIR=${sbindir}'"
+
+do_unpack_append() {
+ bb.build.exec_func('do_copy_openwrt_src', d)
+}
+
+do_copy_openwrt_src() {
+ cp -Rfp ${WORKDIR}/src/* ${S}/
+}
+
+do_filogic_patches() {
+ cd ${S}
+ if [ ! -e patch_applied ]; then
+ patch -p1 < ${WORKDIR}/001-rdkb-remove-ubus-support.patch
+ touch patch_applied
+ fi
+}
+
+addtask filogic_patches after do_patch before do_compile
+
+do_configure () {
+ ${MAKE} -C wpa_supplicant clean
+
+ # For rebuild
+ rm -f wpa_supplicant/*.d wpa_supplicant/dbus/*.d
+}
+
+do_configure_append () {
+ # from Openwrt defconfig
+ install -m 0644 ${WORKDIR}/wpa_supplicant-full.config wpa_supplicant/.config
+
+ # RDKB
+ echo "CONFIG_BUILD_WPA_CLIENT_SO=y" >> wpa_supplicant/.config
+
+ # mtk add
+ echo "CONFIG_MBO=y" >> wpa_supplicant/.config
+ echo "CONFIG_WPS_UPNP=y" >> wpa_supplicant/.config
+ echo "CONFIG_DPP=y" >> wpa_supplicant/.config
+ echo "CONFIG_DPP2=y" >> wpa_supplicant/.config
+ echo "CONFIG_DPP3=y" >> wpa_supplicant/.config
+
+ # OpenWRT hostapd Makefile add
+ echo "CONFIG_ACS=y" >> wpa_supplicant/.config
+ echo "CONFIG_IEEE80211AX=y" >> wpa_supplicant/.config
+ echo "CONFIG_TLS=openssl" >> wpa_supplicant/.config
+ echo "CONFIG_SAE=y" >> wpa_supplicant/.config
+ echo "CONFIG_OWE=y" >> wpa_supplicant/.config
+ echo "CONFIG_SUITEB192=y" >> wpa_supplicant/.config
+ echo "CONFIG_WEP=y" >> wpa_supplicant/.config
+ echo "CONFIG_AP=y" >> wpa_supplicant/.config
+ echo "CONFIG_MESH=y" >> wpa_supplicant/.config
+}
+
+do_compile () {
+ oe_runmake -C wpa_supplicant
+ oe_runmake -C wpa_supplicant libwpa_client.a
+}
+
+do_install () {
+ oe_runmake -C wpa_supplicant DESTDIR="${D}" install
+
+ install -d ${D}${docdir}/wpa_supplicant
+ install -m 644 wpa_supplicant/README ${WORKDIR}/wpa_supplicant.conf ${D}${docdir}/wpa_supplicant
+
+ install -d ${D}${sysconfdir}
+ install -m 600 ${WORKDIR}/wpa_supplicant.conf-sane ${D}${sysconfdir}/wpa_supplicant.conf
+
+ install -d ${D}${sysconfdir}/network/if-pre-up.d/
+ install -d ${D}${sysconfdir}/network/if-post-down.d/
+ install -d ${D}${sysconfdir}/network/if-down.d/
+ install -m 755 ${WORKDIR}/wpa-supplicant.sh ${D}${sysconfdir}/network/if-pre-up.d/wpa-supplicant
+ ln -sf ../if-pre-up.d/wpa-supplicant ${D}${sysconfdir}/network/if-post-down.d/wpa-supplicant
+
+ install -d ${D}/${sysconfdir}/dbus-1/system.d
+ install -m 644 ${S}/wpa_supplicant/dbus/dbus-wpa_supplicant.conf ${D}/${sysconfdir}/dbus-1/system.d
+ install -d ${D}/${datadir}/dbus-1/system-services
+ install -m 644 ${S}/wpa_supplicant/dbus/*.service ${D}/${datadir}/dbus-1/system-services
+
+ if ${@bb.utils.contains('DISTRO_FEATURES','systemd','true','false',d)}; then
+ install -d ${D}/${systemd_system_unitdir}
+ install -m 644 ${S}/wpa_supplicant/systemd/*.service ${D}/${systemd_system_unitdir}
+ fi
+
+ install -d ${D}/etc/default/volatiles
+ install -m 0644 ${WORKDIR}/99_wpa_supplicant ${D}/etc/default/volatiles
+
+ install -d ${D}${includedir}
+ install -m 0644 ${S}/src/common/wpa_ctrl.h ${D}${includedir}
+
+ install -d ${D}${libdir}
+ install -m 0644 ${S}/wpa_supplicant/libwpa_client.so ${D}${libdir}
+}
+
+pkg_postinst:${PN} () {
+ # If we're offline, we don't need to do this.
+ if [ "x$D" = "x" ]; then
+ killall -q -HUP dbus-daemon || true
+ fi
+}
+
+PACKAGE_BEFORE_PN += "${PN}-passphrase ${PN}-cli"
+PACKAGES =+ "${PN}-lib"
+PACKAGES += "${PN}-plugins"
+ALLOW_EMPTY:${PN}-plugins = "1"
+
+PACKAGES_DYNAMIC += "^${PN}-plugin-.*$"
+NOAUTOPACKAGEDEBUG = "1"
+
+FILES:${PN}-passphrase = "${sbindir}/wpa_passphrase"
+FILES:${PN}-cli = "${sbindir}/wpa_cli"
+FILES:${PN} += "${datadir}/dbus-1/system-services/* ${systemd_system_unitdir}/*"
+FILES:${PN}-dbg += "${sbindir}/.debug ${libdir}/.debug"
+
+CONFFILES:${PN} += "${sysconfdir}/wpa_supplicant.conf"
+
+RRECOMMENDS:${PN} = "${PN}-passphrase ${PN}-cli ${PN}-plugins"
+
+SYSTEMD_SERVICE:${PN} = "wpa_supplicant.service"
+SYSTEMD_AUTO_ENABLE = "disable"
+
+# move from cmf
+FILES_SOLIBSDEV = ""
+FILES_${PN} += "${libdir}/libwpa_client.so"
+