Merge "[rdkb][common][config][Fix MBSS issue in hostapd-init.sh]"
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_dbg.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_dbg.c
index c23f868..9987630 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_dbg.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_dbg.c
@@ -40,6 +40,8 @@
u32 hw_lro_timestamp_flush_cnt[MTK_HW_LRO_RING_NUM];
u32 hw_lro_norule_flush_cnt[MTK_HW_LRO_RING_NUM];
u32 mtk_hwlro_stats_ebl;
+u32 dbg_show_level;
+
static struct proc_dir_entry *proc_hw_lro_stats, *proc_hw_lro_auto_tlb;
typedef int (*mtk_lro_dbg_func) (int par);
@@ -396,6 +398,12 @@
} else
pr_info(" device resetting !!!\n");
break;
+ case 4:
+ dbg_show_level = 1;
+ break;
+ case 5:
+ dbg_show_level = 0;
+ break;
default:
pr_info("Usage: echo [level] > /sys/kernel/debug/mtketh/reset\n");
pr_info("Commands: [level]\n");
@@ -403,6 +411,8 @@
pr_info(" 1 FE and WDMA reset\n");
pr_info(" 2 enable reset\n");
pr_info(" 3 FE reset\n");
+ pr_info(" 4 enable dump reset info\n");
+ pr_info(" 5 disable dump reset info\n");
break;
}
return count;
@@ -1846,7 +1856,7 @@
proc_create(PROCREG_RESET_EVENT, 0, proc_reg_dir, &reset_event_fops);
if (!proc_reset_event)
pr_notice("!! FAIL to create %s PROC !!\n", PROCREG_RESET_EVENT);
-
+ dbg_show_level = 1;
return 0;
}
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_reset.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_reset.c
index eebec74..5ab74ad 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_reset.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_reset.c
@@ -25,6 +25,8 @@
static int mtk_wifi_num = 0;
static int mtk_rest_cnt = 0;
u32 mtk_reset_flag = MTK_FE_START_RESET;
+bool mtk_stop_fail;
+
typedef u32 (*mtk_monitor_xdma_func) (struct mtk_eth *eth);
void mtk_reset_event_update(struct mtk_eth *eth, u32 id)
@@ -51,10 +53,12 @@
#endif
ethsys_reset(eth, reset_bits);
- if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2) ||
- MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3))
+ if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN, 0x3ffffff);
+ if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3))
+ regmap_write(eth->ethsys, ETHSYS_FE_RST_CHK_IDLE_EN, 0x6F8FF);
+
return 0;
}
@@ -144,7 +148,8 @@
if (ret) {
mtk_reset_event_update(eth, MTK_EVENT_TOTAL_CNT);
- mtk_dump_netsys_info(eth);
+ if (dbg_show_level)
+ mtk_dump_netsys_info(eth);
}
return ret;
@@ -619,6 +624,7 @@
switch (event) {
case MTK_WIFI_RESET_DONE:
case MTK_FE_STOP_TRAFFIC_DONE:
+ pr_info("%s rcv done event:%x\n", __func__, event);
mtk_rest_cnt--;
if(!mtk_rest_cnt) {
complete(&wait_ser_done);
@@ -633,6 +639,13 @@
mtk_wifi_num--;
mtk_rest_cnt = mtk_wifi_num;
break;
+ case MTK_FE_STOP_TRAFFIC_DONE_FAIL:
+ mtk_stop_fail = true;
+ mtk_reset_flag = MTK_FE_START_RESET;
+ pr_info("%s rcv done event:%x\n", __func__, event);
+ complete(&wait_ser_done);
+ mtk_rest_cnt = mtk_wifi_num;
+ break;
default:
break;
}
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_reset.h b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_reset.h
index 096331b..4ac77c8 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_reset.h
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_reset.h
@@ -18,6 +18,8 @@
#define MTK_FE_STOP_TRAFFIC (0x2005)
#define MTK_FE_STOP_TRAFFIC_DONE (0x2006)
#define MTK_FE_START_TRAFFIC (0x2007)
+#define MTK_FE_STOP_TRAFFIC_DONE_FAIL (0x2008)
+
/* ADMA Rx Debug Monitor */
#define MTK_ADMA_RX_DBG0 (PDMA_BASE + 0x238)
@@ -67,6 +69,7 @@
extern atomic_t reset_lock;
extern struct completion wait_nat_done;
extern u32 mtk_reset_flag;
+extern bool mtk_stop_fail;
irqreturn_t mtk_handle_fe_irq(int irq, void *_eth);
u32 mtk_check_reset_event(struct mtk_eth *eth, u32 status);
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index ad73fdb..05a5595 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -1096,7 +1096,7 @@
{
struct device_node *mii_np;
int max_clk = 2500000, divider;
- int ret;
+ int ret = 0;
u32 val;
mii_np = of_get_child_by_name(eth->dev->of_node, "mdio-bus");
@@ -3959,8 +3959,20 @@
eth->netdev[i]);
}
rtnl_unlock();
- if (!wait_for_completion_timeout(&wait_ser_done, 3000))
+ if (!wait_for_completion_timeout(&wait_ser_done, 3000)) {
+ if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3) &&
+ (mtk_stop_fail)) {
+ pr_info("send MTK_FE_START_RESET stop\n");
+ rtnl_lock();
+ call_netdevice_notifiers(MTK_FE_START_RESET,
+ eth->netdev[i]);
+ rtnl_unlock();
+ if (!wait_for_completion_timeout(&wait_ser_done,
+ 3000))
+ pr_warn("wait for MTK_FE_START_RESET\n");
+ }
pr_warn("wait for MTK_FE_START_RESET\n");
+ }
rtnl_lock();
break;
}
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.h
index f279ad5..03c18f0 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.h
@@ -1822,6 +1822,7 @@
extern struct mtk_eth *g_eth;
extern const struct of_device_id of_mtk_match[];
extern u32 mtk_hwlro_stats_ebl;
+extern u32 dbg_show_level;
/* read the hardware status register */
void mtk_stats_update_mac(struct mtk_mac *mac);
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/thermal/mediatek/soc_temp_lvts.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/thermal/mediatek/soc_temp_lvts.c
index 570ac17..d3f32ca 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/thermal/mediatek/soc_temp_lvts.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/thermal/mediatek/soc_temp_lvts.c
@@ -37,6 +37,7 @@
(DEVICE_WRITE | RG_TSV2F_CTRL_4 << 8 | 0xFC)
#define SET_TS_RSV_V5 (DEVICE_WRITE | RG_TSV2F_CTRL_1 << 8 | 0x8D)
#define SET_TS_EN_V5 (DEVICE_WRITE | RG_TSV2F_CTRL_0 << 8 | 0xF1)
+#define SET_TS_V2VF_RSV_V5 (DEVICE_WRITE | RG_TSV2F_CTRL_3 << 8 | 0x04)
#define SET_MANUAL_RCK_V5 (DEVICE_WRITE | RG_TSV2F_CTRL_6 << 8 | 0x00)
#define SELECT_SENSOR_RCK_V5(id) (DEVICE_WRITE | RG_TSV2F_CTRL_5 << 8 | (id))
@@ -1154,6 +1155,7 @@
i);
lvts_write_device(lvts_data, SET_TS_RSV_V5, i);
lvts_write_device(lvts_data, SET_TS_EN_V5, i);
+ lvts_write_device(lvts_data, SET_TS_V2VF_RSV_V5, i);
}
lvts_data->counting_window_us = 20;
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9990-mt7622-backport-nf-hw-offload-framework-and-ups.patch b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9990-mt7622-backport-nf-hw-offload-framework-and-ups.patch
index a7dfc86..7d4c5d6 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9990-mt7622-backport-nf-hw-offload-framework-and-ups.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9990-mt7622-backport-nf-hw-offload-framework-and-ups.patch
@@ -6125,7 +6125,7 @@
index 000000000..ae1eb2656
--- /dev/null
+++ b/net/netfilter/xt_FLOWOFFLOAD.c
-@@ -0,0 +1,785 @@
+@@ -0,0 +1,776 @@
+/*
+ * Copyright (C) 2018-2021 Felix Fietkau <nbd@nbd.name>
+ *
@@ -6510,28 +6510,19 @@
+ return dev_fill_forward_path(dev, ha, stack);
+}
+
-+static int nf_dev_forward_path(struct sk_buff *skb,
-+ struct nf_flow_route *route,
++static int nf_dev_forward_path(struct nf_flow_route *route,
+ const struct nf_conn *ct,
+ enum ip_conntrack_dir dir,
+ struct net_device **devs)
+{
+ const struct dst_entry *dst = route->tuple[dir].dst;
-+ struct ethhdr *eth = eth_hdr(skb);
+ struct net_device_path_stack stack;
+ struct nf_forward_info info = {};
+ unsigned char ha[ETH_ALEN];
+ int i;
+
-+ if (nf_dev_fill_forward_path(route, dst, ct, dir, ha, &stack) >= 0) {
-+ if (!(ct->status & IPS_NAT_MASK)) {
-+ if (dir == IP_CT_DIR_ORIGINAL)
-+ memcpy(info.h_source, eth->h_source, ETH_ALEN);
-+ else if (dir == IP_CT_DIR_REPLY)
-+ memcpy(info.h_source, eth->h_dest, ETH_ALEN);
-+ }
++ if (nf_dev_fill_forward_path(route, dst, ct, dir, ha, &stack) >= 0)
+ nf_dev_path_info(&stack, &info, ha);
-+ }
+
+ devs[!dir] = (struct net_device *)info.indev;
+ if (!info.indev)
@@ -6617,11 +6608,11 @@
+ nf_default_forward_path(route, this_dst, dir, devs);
+ nf_default_forward_path(route, other_dst, !dir, devs);
+
-+ if (route->tuple[dir].xmit_type == FLOW_OFFLOAD_XMIT_NEIGH &&
++ if (route->tuple[dir].xmit_type == FLOW_OFFLOAD_XMIT_NEIGH &&
+ route->tuple[!dir].xmit_type == FLOW_OFFLOAD_XMIT_NEIGH) {
-+ if (nf_dev_forward_path(skb, route, ct, dir, devs))
++ if (nf_dev_forward_path(route, ct, dir, devs))
+ return -1;
-+ if (nf_dev_forward_path(skb, route, ct, !dir, devs))
++ if (nf_dev_forward_path(route, ct, !dir, devs))
+ return -1;
+ }
+
@@ -6648,10 +6639,10 @@
+ if (ret)
+ goto err_route_dir1;
+
-+ if (route->tuple[dir].xmit_type == FLOW_OFFLOAD_XMIT_NEIGH &&
++ if (route->tuple[dir].xmit_type == FLOW_OFFLOAD_XMIT_NEIGH &&
+ route->tuple[!dir].xmit_type == FLOW_OFFLOAD_XMIT_NEIGH) {
-+ if (nf_dev_forward_path(skb, route, ct, dir, devs) ||
-+ nf_dev_forward_path(skb, route, ct, !dir, devs)) {
++ if (nf_dev_forward_path(route, ct, dir, devs) ||
++ nf_dev_forward_path(route, ct, !dir, devs)) {
+ ret = -1;
+ goto err_route_dir2;
+ }
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/757-net-phy-add-phylink-pcs-support.patch b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/757-net-phy-add-phylink-pcs-support.patch
index f449505..83da92d 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/757-net-phy-add-phylink-pcs-support.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/757-net-phy-add-phylink-pcs-support.patch
@@ -426,7 +426,7 @@
ASSERT_RTNL();
phylink_info(pl, "configuring for %s/%s link mode\n",
-@@ -1029,15 +1215,12 @@ void phylink_start(struct phylink *pl)
+@@ -1029,15 +1215,13 @@ void phylink_start(struct phylink *pl)
/* Apply the link configuration to the MAC when starting. This allows
* a fixed-link to start with the correct parameters, and also
* ensures that we set the appropriate advertisement for Serdes links.
@@ -441,6 +441,7 @@
* switches using 802.3z negotiation to ensure they see our modes.
*/
- phylink_mac_an_restart(pl);
++ phylink_resolve_flow(pl, &pl->link_config);
+ phylink_mac_initial_config(pl, true);
clear_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state);
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch
new file mode 100644
index 0000000..59a0bc5
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch
@@ -0,0 +1,506 @@
+From 8496882339b6e9dc550b491693b8029fc88ac191 Mon Sep 17 00:00:00 2001
+From: mtk23888 <dipanshu.mittal@mediatek.com>
+Date: Tue, 4 Apr 2023 13:06:41 +0800
+Subject: [PATCH] Air Monitor support in hostapd by vendor NL
+
+Signed-off-by: mtk23888 <dipanshu.mittal@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 113 +++++++++++++++++++
+ hostapd/hostapd_cli.c | 15 +++
+ src/ap/ap_drv_ops.c | 14 +++
+ src/ap/ap_drv_ops.h | 3 +
+ src/common/mtk_vendor.h | 8 ++
+ src/drivers/driver.h | 16 +++
+ src/drivers/driver_nl80211.c | 180 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 2 +
+ 9 files changed, 352 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index f338d0f..7f91cb6 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3765,6 +3765,44 @@ hostapd_ctrl_iface_ap_wireless(struct hostapd_data *hapd, char *cmd,
+
+ if (hostapd_drv_ap_wireless(hapd, (u8) sub_cmd, atoi(value)) != 0)
+ return -1;
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++static int
++hostapd_ctrl_iface_set_amnt(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *tmp, sta_mac[ETH_ALEN] = {0};
++ int amnt_idx = 0;
++
++ tmp = strtok_r(cmd, " ", &cmd);
++
++ if (!tmp) {
++ wpa_printf(MSG_ERROR, "Error in command format\n");
++ return -1;
++ }
++
++ amnt_idx = strtol(tmp, &tmp, 10);
++
++ if (amnt_idx < 0 || amnt_idx > 15) {
++ wpa_printf(MSG_ERROR, "Wrong AMNT index %d\n", amnt_idx);
++ return -1;
++ }
++
++ if (!cmd) {
++ wpa_printf(MSG_ERROR, "Error in command format\n");
++ return -1;
++ }
++
++ if (hwaddr_aton(cmd, sta_mac) < 0) {
++ wpa_printf(MSG_ERROR, "station mac is not right.\n");
++ return -1;
++ }
++
++ if (hostapd_drv_amnt_set(hapd, amnt_idx, sta_mac)) {
++ wpa_printf(MSG_ERROR, "Not able to set amnt index\n");
++ return -1;
++ }
+
+ return os_snprintf(buf, buflen, "OK\n");
+ }
+@@ -3818,6 +3856,75 @@ exit:
+ return os_snprintf(buf, buflen, "OK\n");
+ }
+
++static int
++hostapd_ctrl_iface_dump_amnt(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *tmp;
++ int amnt_idx = 0, ret = 0;
++ struct amnt_resp_data *resp_buf;
++ char *pos, *end;
++ struct amnt_data *res;
++
++ pos = buf;
++ end = buf + buflen;
++
++ tmp = strtok_r(cmd, " ", &cmd);
++
++ if (!tmp) {
++ wpa_printf(MSG_ERROR, "Error in command format\n");
++ return -1;
++ }
++
++ amnt_idx = strtoul(tmp, &tmp, 0);
++
++ if ((amnt_idx < 0 || amnt_idx > 15) && amnt_idx != 0xff) {
++ wpa_printf(MSG_ERROR, "Wrong AMNT index\n");
++ return -1;
++ }
++
++ if (amnt_idx == 0xff)
++ resp_buf = (struct amnt_resp_data *) os_zalloc(AIR_MONITOR_MAX_ENTRY
++ * sizeof(struct amnt_data) + 1);
++ else
++ resp_buf = (struct amnt_resp_data *) os_zalloc(sizeof(struct amnt_data) + 1);
++
++ if (resp_buf == NULL) {
++ wpa_printf(MSG_ERROR, "Error in memory allocation\n");
++ return -1;
++ }
++
++ if (hostapd_drv_amnt_dump(hapd, amnt_idx, (u8 *)resp_buf)) {
++ wpa_printf(MSG_ERROR, "Not able to set amnt index\n");
++ os_free(resp_buf);
++ return -1;
++ }
++
++ for (int i = 0; i < resp_buf->sta_num && i < AIR_MONITOR_MAX_ENTRY; i++) {
++ res = &resp_buf->resp_data[i];
++ ret = os_snprintf(pos, end - pos,
++ "[hostapd_cli] amnt_idx: %d, addr="MACSTR
++ ", rssi=%d/%d/%d/%d, last_seen=%u\n",
++ res->idx,
++ MAC2STR(res->addr), res->rssi[0],
++ res->rssi[1], res->rssi[2],
++ res->rssi[3], res->last_seen);
++ if (os_snprintf_error(end - pos, ret)) {
++ os_free(resp_buf);
++ return 0;
++ }
++ pos = pos + ret;
++ }
++
++ os_free(resp_buf);
++
++ if (pos == buf)
++ return os_snprintf(buf, buflen, "Index %d is not monitored\n",
++ amnt_idx);
++ else
++ return pos - buf;
++}
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -4392,6 +4499,12 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_len = hostapd_ctrl_iface_ap_wireless(hapd, buf + 12, reply, reply_size);
+ } else if (os_strncmp(buf, "ap_rfeatures ", 13) == 0) {
+ reply_len = hostapd_ctrl_iface_ap_rfeatures(hapd, buf + 13, reply, reply_size);
++ } else if (os_strncmp(buf, "SET_AMNT", 8) == 0) {
++ reply_len = hostapd_ctrl_iface_set_amnt(hapd, buf+9,
++ reply, reply_size);
++ } else if (os_strncmp(buf, "DUMP_AMNT", 9) == 0) {
++ reply_len = hostapd_ctrl_iface_dump_amnt(hapd, buf+10,
++ reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index aad7aa5..0c4a176 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1613,6 +1613,17 @@ static int hostapd_cli_cmd_get_amsdu(struct wpa_ctrl *ctrl, int argc,
+ return hostapd_cli_cmd(ctrl, "GET_AMSDU", 0, NULL, NULL);
+ }
+
++static int hostapd_cli_cmd_set_amnt(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "SET_AMNT", 2, argc, argv);
++}
++
++static int hostapd_cli_cmd_dump_amnt(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "DUMP_AMNT", 1, argc, argv);
++}
+
+ struct hostapd_cli_cmd {
+ const char *cmd;
+@@ -1823,6 +1834,10 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ " = show iBF state (enabled/disabled)"},
+ { "get_amsdu", hostapd_cli_cmd_get_amsdu, NULL,
+ " = show AMSDU state"},
++ { "set_amnt", hostapd_cli_cmd_set_amnt, NULL,
++ " = Set Station index and mac to monitor"},
++ { "dump_amnt", hostapd_cli_cmd_dump_amnt, NULL,
++ " = Dump RSSI of monitoring Station"},
+ { NULL, NULL, NULL, NULL }
+ };
+
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 52d0fff..eafa588 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1121,3 +1121,17 @@ int hostapd_drv_ap_trig_type(struct hostapd_data *hapd, u8 enable, u8 type)
+ return 0;
+ return hapd->driver->ap_trigtype(hapd->drv_priv, enable, type);
+ }
++
++int hostapd_drv_amnt_set(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_sta_mac)
++{
++ if (!hapd->driver || !hapd->driver->amnt_set)
++ return 0;
++ return hapd->driver->amnt_set(hapd->drv_priv, amnt_idx, amnt_sta_mac);
++}
++
++int hostapd_drv_amnt_dump(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_dump_buf)
++{
++ if (!hapd->driver || !hapd->driver->amnt_dump)
++ return 0;
++ return hapd->driver->amnt_dump(hapd->drv_priv, amnt_idx, amnt_dump_buf);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 659c3f8..28f2a4d 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -155,6 +155,9 @@ int hostapd_drv_ap_wireless(struct hostapd_data *hapd, u8 sub_vendor_id, int val
+ int hostapd_drv_ap_rfeatures(struct hostapd_data *hapd, u8 sub_vendor_id, int value);
+ int hostapd_drv_ap_trig_type(struct hostapd_data *hapd, u8 enable, u8 type);
+
++int hostapd_drv_amnt_set(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_sta_mac);
++int hostapd_drv_amnt_dump(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_dump_buf);
++
+ #include "drivers/driver.h"
+
+ int hostapd_drv_wnm_oper(struct hostapd_data *hapd,
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 32438af..74f467c 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -256,10 +256,18 @@ struct csi_data {
+ u16 rx_idx;
+ };
+
++#define AIR_MONITOR_MAX_ENTRY 16
++
+ struct amnt_data {
+ u8 idx;
+ u8 addr[ETH_ALEN];
+ s8 rssi[4];
+ u32 last_seen;
+ };
++
++struct amnt_resp_data {
++ u8 sta_num;
++ struct amnt_data resp_data[0];
++};
++
+ #endif /* MTK_VENDOR_H */
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 6a46832..1444cbe 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4809,6 +4809,22 @@ struct wpa_driver_ops {
+ * @type: trigger type
+ */
+ int (*ap_trigtype)(void *priv, u8 enable, u8 type);
++
++ /**
++ * amnt_set - add/delete station from monitoring
++ * @priv: Private driver interface data
++ * @amnt_idx: Monitor Index
++ * @amnt_sta_mac: station mac address
++ */
++ int (*amnt_set)(void *priv, u8 amnt_idx, u8 *amnt_sta_mac);
++
++ /**
++ * amnt_dump - Dump particular/ all station
++ * @priv: Private driver interface data
++ * @amnt_idx: Monitor Index
++ * @amnt_dump_buf: Buffer to print
++ */
++ int (*amnt_dump)(void *priv, u8 amnt_idx, u8 *amnt_dump_buf);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 7fae013..0470079 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -125,6 +125,19 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
+ [MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
+ };
+
++static struct nla_policy
++amnt_ctrl_policy[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL] = {
++ [MTK_VENDOR_ATTR_AMNT_CTRL_SET] = {.type = NLA_NESTED },
++ [MTK_VENDOR_ATTR_AMNT_CTRL_DUMP] = { .type = NLA_NESTED },
++};
++
++static struct nla_policy
++amnt_dump_policy[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP] = {
++ [MTK_VENDOR_ATTR_AMNT_DUMP_INDEX] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_AMNT_DUMP_LEN] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_AMNT_DUMP_RESULT] = { .type = NLA_NESTED },
++};
++
+ static struct nl_sock * nl_create_handle(struct nl_cb *cb, const char *dbg)
+ {
+ struct nl_sock *handle;
+@@ -13196,6 +13209,171 @@ fail:
+ return -ENOBUFS;
+ }
+
++static int
++nl80211_amnt_set(void *priv, u8 amnt_idx, u8 *amnt_sta_mac)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ void *tb1;
++ int ret;
++
++ if (!drv->mtk_amnt_vendor_cmd_avail) {
++ wpa_printf(MSG_ERROR,
++ "nl80211: Driver does not support air monitor");
++ return 0;
++ }
++
++ msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
++ if (!data)
++ goto fail;
++
++ tb1 = nla_nest_start(msg, MTK_VENDOR_ATTR_AMNT_CTRL_SET);
++ if (!tb1)
++ goto fail;
++
++ nla_put_u8(msg, MTK_VENDOR_ATTR_AMNT_SET_INDEX, amnt_idx);
++
++ nla_put(msg, MTK_VENDOR_ATTR_AMNT_SET_MACADDR, ETH_ALEN, amnt_sta_mac);
++
++ nla_nest_end(msg, tb1);
++ nla_nest_end(msg, data);
++
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++
++ if (ret)
++ wpa_printf(MSG_ERROR, "Failed to set air monitor. ret=%d (%s)",
++ ret, strerror(-ret));
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++
++}
++
++static int
++mt76_amnt_dump_cb(struct nl_msg *msg, void *arg)
++{
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb1[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL];
++ struct nlattr *tb2[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP];
++ struct nlattr *attr, *cur, *data;
++ struct amnt_data *res;
++ int len = 0, rem;
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct amnt_resp_data *amnt_dump = (struct amnt_resp_data *)arg;
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ attr = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!attr)
++ return NL_SKIP;
++
++ nla_parse_nested(tb1, MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
++ attr, amnt_ctrl_policy);
++
++ if (!tb1[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP])
++ return NL_SKIP;
++
++ nla_parse_nested(tb2, NUM_MTK_VENDOR_ATTRS_AMNT_DUMP,
++ tb1[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP], amnt_dump_policy);
++
++ if (!tb2[MTK_VENDOR_ATTR_AMNT_DUMP_LEN])
++ return NL_SKIP;
++
++ len = nla_get_u8(tb2[MTK_VENDOR_ATTR_AMNT_DUMP_LEN]);
++ if (!len)
++ return 0;
++
++ if (!tb2[MTK_VENDOR_ATTR_AMNT_DUMP_RESULT])
++ return NL_SKIP;
++
++ data = tb2[MTK_VENDOR_ATTR_AMNT_DUMP_RESULT];
++
++ nla_for_each_nested(cur, data, rem) {
++ if (amnt_dump->sta_num >= AIR_MONITOR_MAX_ENTRY)
++ return NL_SKIP;
++ res = (struct amnt_data *) nla_data(cur);
++ wpa_printf(MSG_ERROR, "[vendor] amnt_idx: %d, "
++ "addr="MACSTR", "
++ "rssi=%d/%d/%d/%d, last_seen=%u\n",
++ res->idx,
++ MAC2STR(res->addr),
++ res->rssi[0], res->rssi[1], res->rssi[2],
++ res->rssi[3], res->last_seen);
++ os_memcpy(&amnt_dump->resp_data[amnt_dump->sta_num], res,
++ sizeof(struct amnt_data));
++ amnt_dump->sta_num++;
++ }
++ return 0;
++}
++
++static int
++nl80211_amnt_dump(void *priv, u8 amnt_idx, u8 *dump_buf)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ void *tb1;
++ int ret;
++
++ if (!drv->mtk_amnt_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support air monitor");
++ return 0;
++ }
++
++ msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
++ if (!data)
++ goto fail;
++
++ tb1 = nla_nest_start(msg, MTK_VENDOR_ATTR_AMNT_CTRL_DUMP
++ | NLA_F_NESTED);
++ if (!tb1)
++ goto fail;
++
++ nla_put_u8(msg, MTK_VENDOR_ATTR_AMNT_DUMP_INDEX, amnt_idx);
++
++ nla_nest_end(msg, tb1);
++ nla_nest_end(msg, data);
++
++ ret = send_and_recv_msgs(drv, msg, mt76_amnt_dump_cb,
++ dump_buf, NULL, NULL);
++
++ if (ret)
++ wpa_printf(MSG_ERROR, "Failed to Dump air monitor. ret=%d (%s)"
++ , ret, strerror(-ret));
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+ .desc = "Linux nl80211/cfg80211",
+@@ -13356,4 +13534,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .ap_wireless = nl80211_ap_wireless,
+ .ap_rfeatures = nl80211_ap_rfeatures,
+ .ap_trigtype = nl80211_ap_trigtype,
++ .amnt_set = nl80211_amnt_set,
++ .amnt_dump = nl80211_amnt_dump,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 7a03446..7dd88e7 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -188,6 +188,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int mtk_wireless_vendor_cmd_avail:1;
+ unsigned int mtk_bss_color_vendor_cmd_avail:1;
+ unsigned int mtk_rfeatures_vendor_cmd_avail:1;
++ unsigned int mtk_amnt_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 6f4d029..5c1a35d 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1094,6 +1094,8 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ break;
+ case MTK_NL80211_VENDOR_SUBCMD_BSS_COLOR_CTRL :
+ drv->mtk_bss_color_vendor_cmd_avail = 1;
++ case MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL:
++ drv->mtk_amnt_vendor_cmd_avail = 1;
+ break;
+ case MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL:
+ drv->mtk_rfeatures_vendor_cmd_avail = 1;
+--
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc b/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
index 90c3ba0..f5475c8 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
@@ -88,6 +88,7 @@
file://mtk-0024-hostapd-mtk-Add-support-for-masking-EHT-capabilities.patch \
file://mtk-0025-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch \
file://mtk-0026-hostapd-mtk-Add-vendor-for-CAPI-certification-comman.patch \
+ file://mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch \
file://mtk-0027-hostapd-mtk-Fix-scan-result-updating-issue.patch \
file://mtk-0100-hostapd-mtk-update-eht-operation-elem.patch \
"
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch b/recipes-wifi/hostapd/files/patches/mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch
new file mode 100644
index 0000000..59a0bc5
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch
@@ -0,0 +1,506 @@
+From 8496882339b6e9dc550b491693b8029fc88ac191 Mon Sep 17 00:00:00 2001
+From: mtk23888 <dipanshu.mittal@mediatek.com>
+Date: Tue, 4 Apr 2023 13:06:41 +0800
+Subject: [PATCH] Air Monitor support in hostapd by vendor NL
+
+Signed-off-by: mtk23888 <dipanshu.mittal@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 113 +++++++++++++++++++
+ hostapd/hostapd_cli.c | 15 +++
+ src/ap/ap_drv_ops.c | 14 +++
+ src/ap/ap_drv_ops.h | 3 +
+ src/common/mtk_vendor.h | 8 ++
+ src/drivers/driver.h | 16 +++
+ src/drivers/driver_nl80211.c | 180 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 2 +
+ 9 files changed, 352 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index f338d0f..7f91cb6 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3765,6 +3765,44 @@ hostapd_ctrl_iface_ap_wireless(struct hostapd_data *hapd, char *cmd,
+
+ if (hostapd_drv_ap_wireless(hapd, (u8) sub_cmd, atoi(value)) != 0)
+ return -1;
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++static int
++hostapd_ctrl_iface_set_amnt(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *tmp, sta_mac[ETH_ALEN] = {0};
++ int amnt_idx = 0;
++
++ tmp = strtok_r(cmd, " ", &cmd);
++
++ if (!tmp) {
++ wpa_printf(MSG_ERROR, "Error in command format\n");
++ return -1;
++ }
++
++ amnt_idx = strtol(tmp, &tmp, 10);
++
++ if (amnt_idx < 0 || amnt_idx > 15) {
++ wpa_printf(MSG_ERROR, "Wrong AMNT index %d\n", amnt_idx);
++ return -1;
++ }
++
++ if (!cmd) {
++ wpa_printf(MSG_ERROR, "Error in command format\n");
++ return -1;
++ }
++
++ if (hwaddr_aton(cmd, sta_mac) < 0) {
++ wpa_printf(MSG_ERROR, "station mac is not right.\n");
++ return -1;
++ }
++
++ if (hostapd_drv_amnt_set(hapd, amnt_idx, sta_mac)) {
++ wpa_printf(MSG_ERROR, "Not able to set amnt index\n");
++ return -1;
++ }
+
+ return os_snprintf(buf, buflen, "OK\n");
+ }
+@@ -3818,6 +3856,75 @@ exit:
+ return os_snprintf(buf, buflen, "OK\n");
+ }
+
++static int
++hostapd_ctrl_iface_dump_amnt(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *tmp;
++ int amnt_idx = 0, ret = 0;
++ struct amnt_resp_data *resp_buf;
++ char *pos, *end;
++ struct amnt_data *res;
++
++ pos = buf;
++ end = buf + buflen;
++
++ tmp = strtok_r(cmd, " ", &cmd);
++
++ if (!tmp) {
++ wpa_printf(MSG_ERROR, "Error in command format\n");
++ return -1;
++ }
++
++ amnt_idx = strtoul(tmp, &tmp, 0);
++
++ if ((amnt_idx < 0 || amnt_idx > 15) && amnt_idx != 0xff) {
++ wpa_printf(MSG_ERROR, "Wrong AMNT index\n");
++ return -1;
++ }
++
++ if (amnt_idx == 0xff)
++ resp_buf = (struct amnt_resp_data *) os_zalloc(AIR_MONITOR_MAX_ENTRY
++ * sizeof(struct amnt_data) + 1);
++ else
++ resp_buf = (struct amnt_resp_data *) os_zalloc(sizeof(struct amnt_data) + 1);
++
++ if (resp_buf == NULL) {
++ wpa_printf(MSG_ERROR, "Error in memory allocation\n");
++ return -1;
++ }
++
++ if (hostapd_drv_amnt_dump(hapd, amnt_idx, (u8 *)resp_buf)) {
++ wpa_printf(MSG_ERROR, "Not able to set amnt index\n");
++ os_free(resp_buf);
++ return -1;
++ }
++
++ for (int i = 0; i < resp_buf->sta_num && i < AIR_MONITOR_MAX_ENTRY; i++) {
++ res = &resp_buf->resp_data[i];
++ ret = os_snprintf(pos, end - pos,
++ "[hostapd_cli] amnt_idx: %d, addr="MACSTR
++ ", rssi=%d/%d/%d/%d, last_seen=%u\n",
++ res->idx,
++ MAC2STR(res->addr), res->rssi[0],
++ res->rssi[1], res->rssi[2],
++ res->rssi[3], res->last_seen);
++ if (os_snprintf_error(end - pos, ret)) {
++ os_free(resp_buf);
++ return 0;
++ }
++ pos = pos + ret;
++ }
++
++ os_free(resp_buf);
++
++ if (pos == buf)
++ return os_snprintf(buf, buflen, "Index %d is not monitored\n",
++ amnt_idx);
++ else
++ return pos - buf;
++}
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -4392,6 +4499,12 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_len = hostapd_ctrl_iface_ap_wireless(hapd, buf + 12, reply, reply_size);
+ } else if (os_strncmp(buf, "ap_rfeatures ", 13) == 0) {
+ reply_len = hostapd_ctrl_iface_ap_rfeatures(hapd, buf + 13, reply, reply_size);
++ } else if (os_strncmp(buf, "SET_AMNT", 8) == 0) {
++ reply_len = hostapd_ctrl_iface_set_amnt(hapd, buf+9,
++ reply, reply_size);
++ } else if (os_strncmp(buf, "DUMP_AMNT", 9) == 0) {
++ reply_len = hostapd_ctrl_iface_dump_amnt(hapd, buf+10,
++ reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index aad7aa5..0c4a176 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1613,6 +1613,17 @@ static int hostapd_cli_cmd_get_amsdu(struct wpa_ctrl *ctrl, int argc,
+ return hostapd_cli_cmd(ctrl, "GET_AMSDU", 0, NULL, NULL);
+ }
+
++static int hostapd_cli_cmd_set_amnt(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "SET_AMNT", 2, argc, argv);
++}
++
++static int hostapd_cli_cmd_dump_amnt(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "DUMP_AMNT", 1, argc, argv);
++}
+
+ struct hostapd_cli_cmd {
+ const char *cmd;
+@@ -1823,6 +1834,10 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ " = show iBF state (enabled/disabled)"},
+ { "get_amsdu", hostapd_cli_cmd_get_amsdu, NULL,
+ " = show AMSDU state"},
++ { "set_amnt", hostapd_cli_cmd_set_amnt, NULL,
++ " = Set Station index and mac to monitor"},
++ { "dump_amnt", hostapd_cli_cmd_dump_amnt, NULL,
++ " = Dump RSSI of monitoring Station"},
+ { NULL, NULL, NULL, NULL }
+ };
+
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 52d0fff..eafa588 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1121,3 +1121,17 @@ int hostapd_drv_ap_trig_type(struct hostapd_data *hapd, u8 enable, u8 type)
+ return 0;
+ return hapd->driver->ap_trigtype(hapd->drv_priv, enable, type);
+ }
++
++int hostapd_drv_amnt_set(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_sta_mac)
++{
++ if (!hapd->driver || !hapd->driver->amnt_set)
++ return 0;
++ return hapd->driver->amnt_set(hapd->drv_priv, amnt_idx, amnt_sta_mac);
++}
++
++int hostapd_drv_amnt_dump(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_dump_buf)
++{
++ if (!hapd->driver || !hapd->driver->amnt_dump)
++ return 0;
++ return hapd->driver->amnt_dump(hapd->drv_priv, amnt_idx, amnt_dump_buf);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 659c3f8..28f2a4d 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -155,6 +155,9 @@ int hostapd_drv_ap_wireless(struct hostapd_data *hapd, u8 sub_vendor_id, int val
+ int hostapd_drv_ap_rfeatures(struct hostapd_data *hapd, u8 sub_vendor_id, int value);
+ int hostapd_drv_ap_trig_type(struct hostapd_data *hapd, u8 enable, u8 type);
+
++int hostapd_drv_amnt_set(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_sta_mac);
++int hostapd_drv_amnt_dump(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_dump_buf);
++
+ #include "drivers/driver.h"
+
+ int hostapd_drv_wnm_oper(struct hostapd_data *hapd,
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 32438af..74f467c 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -256,10 +256,18 @@ struct csi_data {
+ u16 rx_idx;
+ };
+
++#define AIR_MONITOR_MAX_ENTRY 16
++
+ struct amnt_data {
+ u8 idx;
+ u8 addr[ETH_ALEN];
+ s8 rssi[4];
+ u32 last_seen;
+ };
++
++struct amnt_resp_data {
++ u8 sta_num;
++ struct amnt_data resp_data[0];
++};
++
+ #endif /* MTK_VENDOR_H */
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 6a46832..1444cbe 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4809,6 +4809,22 @@ struct wpa_driver_ops {
+ * @type: trigger type
+ */
+ int (*ap_trigtype)(void *priv, u8 enable, u8 type);
++
++ /**
++ * amnt_set - add/delete station from monitoring
++ * @priv: Private driver interface data
++ * @amnt_idx: Monitor Index
++ * @amnt_sta_mac: station mac address
++ */
++ int (*amnt_set)(void *priv, u8 amnt_idx, u8 *amnt_sta_mac);
++
++ /**
++ * amnt_dump - Dump particular/ all station
++ * @priv: Private driver interface data
++ * @amnt_idx: Monitor Index
++ * @amnt_dump_buf: Buffer to print
++ */
++ int (*amnt_dump)(void *priv, u8 amnt_idx, u8 *amnt_dump_buf);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 7fae013..0470079 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -125,6 +125,19 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
+ [MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
+ };
+
++static struct nla_policy
++amnt_ctrl_policy[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL] = {
++ [MTK_VENDOR_ATTR_AMNT_CTRL_SET] = {.type = NLA_NESTED },
++ [MTK_VENDOR_ATTR_AMNT_CTRL_DUMP] = { .type = NLA_NESTED },
++};
++
++static struct nla_policy
++amnt_dump_policy[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP] = {
++ [MTK_VENDOR_ATTR_AMNT_DUMP_INDEX] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_AMNT_DUMP_LEN] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_AMNT_DUMP_RESULT] = { .type = NLA_NESTED },
++};
++
+ static struct nl_sock * nl_create_handle(struct nl_cb *cb, const char *dbg)
+ {
+ struct nl_sock *handle;
+@@ -13196,6 +13209,171 @@ fail:
+ return -ENOBUFS;
+ }
+
++static int
++nl80211_amnt_set(void *priv, u8 amnt_idx, u8 *amnt_sta_mac)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ void *tb1;
++ int ret;
++
++ if (!drv->mtk_amnt_vendor_cmd_avail) {
++ wpa_printf(MSG_ERROR,
++ "nl80211: Driver does not support air monitor");
++ return 0;
++ }
++
++ msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
++ if (!data)
++ goto fail;
++
++ tb1 = nla_nest_start(msg, MTK_VENDOR_ATTR_AMNT_CTRL_SET);
++ if (!tb1)
++ goto fail;
++
++ nla_put_u8(msg, MTK_VENDOR_ATTR_AMNT_SET_INDEX, amnt_idx);
++
++ nla_put(msg, MTK_VENDOR_ATTR_AMNT_SET_MACADDR, ETH_ALEN, amnt_sta_mac);
++
++ nla_nest_end(msg, tb1);
++ nla_nest_end(msg, data);
++
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++
++ if (ret)
++ wpa_printf(MSG_ERROR, "Failed to set air monitor. ret=%d (%s)",
++ ret, strerror(-ret));
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++
++}
++
++static int
++mt76_amnt_dump_cb(struct nl_msg *msg, void *arg)
++{
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb1[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL];
++ struct nlattr *tb2[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP];
++ struct nlattr *attr, *cur, *data;
++ struct amnt_data *res;
++ int len = 0, rem;
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct amnt_resp_data *amnt_dump = (struct amnt_resp_data *)arg;
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ attr = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!attr)
++ return NL_SKIP;
++
++ nla_parse_nested(tb1, MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
++ attr, amnt_ctrl_policy);
++
++ if (!tb1[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP])
++ return NL_SKIP;
++
++ nla_parse_nested(tb2, NUM_MTK_VENDOR_ATTRS_AMNT_DUMP,
++ tb1[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP], amnt_dump_policy);
++
++ if (!tb2[MTK_VENDOR_ATTR_AMNT_DUMP_LEN])
++ return NL_SKIP;
++
++ len = nla_get_u8(tb2[MTK_VENDOR_ATTR_AMNT_DUMP_LEN]);
++ if (!len)
++ return 0;
++
++ if (!tb2[MTK_VENDOR_ATTR_AMNT_DUMP_RESULT])
++ return NL_SKIP;
++
++ data = tb2[MTK_VENDOR_ATTR_AMNT_DUMP_RESULT];
++
++ nla_for_each_nested(cur, data, rem) {
++ if (amnt_dump->sta_num >= AIR_MONITOR_MAX_ENTRY)
++ return NL_SKIP;
++ res = (struct amnt_data *) nla_data(cur);
++ wpa_printf(MSG_ERROR, "[vendor] amnt_idx: %d, "
++ "addr="MACSTR", "
++ "rssi=%d/%d/%d/%d, last_seen=%u\n",
++ res->idx,
++ MAC2STR(res->addr),
++ res->rssi[0], res->rssi[1], res->rssi[2],
++ res->rssi[3], res->last_seen);
++ os_memcpy(&amnt_dump->resp_data[amnt_dump->sta_num], res,
++ sizeof(struct amnt_data));
++ amnt_dump->sta_num++;
++ }
++ return 0;
++}
++
++static int
++nl80211_amnt_dump(void *priv, u8 amnt_idx, u8 *dump_buf)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ void *tb1;
++ int ret;
++
++ if (!drv->mtk_amnt_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support air monitor");
++ return 0;
++ }
++
++ msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
++ if (!data)
++ goto fail;
++
++ tb1 = nla_nest_start(msg, MTK_VENDOR_ATTR_AMNT_CTRL_DUMP
++ | NLA_F_NESTED);
++ if (!tb1)
++ goto fail;
++
++ nla_put_u8(msg, MTK_VENDOR_ATTR_AMNT_DUMP_INDEX, amnt_idx);
++
++ nla_nest_end(msg, tb1);
++ nla_nest_end(msg, data);
++
++ ret = send_and_recv_msgs(drv, msg, mt76_amnt_dump_cb,
++ dump_buf, NULL, NULL);
++
++ if (ret)
++ wpa_printf(MSG_ERROR, "Failed to Dump air monitor. ret=%d (%s)"
++ , ret, strerror(-ret));
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+ .desc = "Linux nl80211/cfg80211",
+@@ -13356,4 +13534,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .ap_wireless = nl80211_ap_wireless,
+ .ap_rfeatures = nl80211_ap_rfeatures,
+ .ap_trigtype = nl80211_ap_trigtype,
++ .amnt_set = nl80211_amnt_set,
++ .amnt_dump = nl80211_amnt_dump,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 7a03446..7dd88e7 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -188,6 +188,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int mtk_wireless_vendor_cmd_avail:1;
+ unsigned int mtk_bss_color_vendor_cmd_avail:1;
+ unsigned int mtk_rfeatures_vendor_cmd_avail:1;
++ unsigned int mtk_amnt_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 6f4d029..5c1a35d 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1094,6 +1094,8 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ break;
+ case MTK_NL80211_VENDOR_SUBCMD_BSS_COLOR_CTRL :
+ drv->mtk_bss_color_vendor_cmd_avail = 1;
++ case MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL:
++ drv->mtk_amnt_vendor_cmd_avail = 1;
+ break;
+ case MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL:
+ drv->mtk_rfeatures_vendor_cmd_avail = 1;
+--
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches/patches.inc b/recipes-wifi/hostapd/files/patches/patches.inc
index 775c230..addbce2 100644
--- a/recipes-wifi/hostapd/files/patches/patches.inc
+++ b/recipes-wifi/hostapd/files/patches/patches.inc
@@ -88,5 +88,6 @@
file://mtk-0024-hostapd-mtk-Add-support-for-masking-EHT-capabilities.patch \
file://mtk-0025-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch \
file://mtk-0026-hostapd-mtk-Add-vendor-for-CAPI-certification-comman.patch \
+ file://mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch \
file://mtk-0027-hostapd-mtk-Fix-scan-result-updating-issue.patch \
"
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_rom_patch.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_rom_patch.bin
index e2b9fe9..1f53b53 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_rom_patch.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_rom_patch.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wa.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wa.bin
index b751e4f..f6472a9 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wa.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wa.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wm.bin
index cab4e0c..29fb94f 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wm.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wm.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch.bin
index c241223..8460c44 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin
index 763dc42..87531e4 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wa.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wa.bin
index 98f1ee4..c90d3d4 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wa.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wa.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm.bin
index d393c7f..4597f31 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin
index f14162b..d36e93e 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_0.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_0.bin
index 4a5c337..aeb2778 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_0.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_0.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_1.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_1.bin
index 2f531a8..b7014ae 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_1.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_1.bin
Binary files differ
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch
new file mode 100644
index 0000000..59a0bc5
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch
@@ -0,0 +1,506 @@
+From 8496882339b6e9dc550b491693b8029fc88ac191 Mon Sep 17 00:00:00 2001
+From: mtk23888 <dipanshu.mittal@mediatek.com>
+Date: Tue, 4 Apr 2023 13:06:41 +0800
+Subject: [PATCH] Air Monitor support in hostapd by vendor NL
+
+Signed-off-by: mtk23888 <dipanshu.mittal@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 113 +++++++++++++++++++
+ hostapd/hostapd_cli.c | 15 +++
+ src/ap/ap_drv_ops.c | 14 +++
+ src/ap/ap_drv_ops.h | 3 +
+ src/common/mtk_vendor.h | 8 ++
+ src/drivers/driver.h | 16 +++
+ src/drivers/driver_nl80211.c | 180 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 2 +
+ 9 files changed, 352 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index f338d0f..7f91cb6 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3765,6 +3765,44 @@ hostapd_ctrl_iface_ap_wireless(struct hostapd_data *hapd, char *cmd,
+
+ if (hostapd_drv_ap_wireless(hapd, (u8) sub_cmd, atoi(value)) != 0)
+ return -1;
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++static int
++hostapd_ctrl_iface_set_amnt(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *tmp, sta_mac[ETH_ALEN] = {0};
++ int amnt_idx = 0;
++
++ tmp = strtok_r(cmd, " ", &cmd);
++
++ if (!tmp) {
++ wpa_printf(MSG_ERROR, "Error in command format\n");
++ return -1;
++ }
++
++ amnt_idx = strtol(tmp, &tmp, 10);
++
++ if (amnt_idx < 0 || amnt_idx > 15) {
++ wpa_printf(MSG_ERROR, "Wrong AMNT index %d\n", amnt_idx);
++ return -1;
++ }
++
++ if (!cmd) {
++ wpa_printf(MSG_ERROR, "Error in command format\n");
++ return -1;
++ }
++
++ if (hwaddr_aton(cmd, sta_mac) < 0) {
++ wpa_printf(MSG_ERROR, "station mac is not right.\n");
++ return -1;
++ }
++
++ if (hostapd_drv_amnt_set(hapd, amnt_idx, sta_mac)) {
++ wpa_printf(MSG_ERROR, "Not able to set amnt index\n");
++ return -1;
++ }
+
+ return os_snprintf(buf, buflen, "OK\n");
+ }
+@@ -3818,6 +3856,75 @@ exit:
+ return os_snprintf(buf, buflen, "OK\n");
+ }
+
++static int
++hostapd_ctrl_iface_dump_amnt(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *tmp;
++ int amnt_idx = 0, ret = 0;
++ struct amnt_resp_data *resp_buf;
++ char *pos, *end;
++ struct amnt_data *res;
++
++ pos = buf;
++ end = buf + buflen;
++
++ tmp = strtok_r(cmd, " ", &cmd);
++
++ if (!tmp) {
++ wpa_printf(MSG_ERROR, "Error in command format\n");
++ return -1;
++ }
++
++ amnt_idx = strtoul(tmp, &tmp, 0);
++
++ if ((amnt_idx < 0 || amnt_idx > 15) && amnt_idx != 0xff) {
++ wpa_printf(MSG_ERROR, "Wrong AMNT index\n");
++ return -1;
++ }
++
++ if (amnt_idx == 0xff)
++ resp_buf = (struct amnt_resp_data *) os_zalloc(AIR_MONITOR_MAX_ENTRY
++ * sizeof(struct amnt_data) + 1);
++ else
++ resp_buf = (struct amnt_resp_data *) os_zalloc(sizeof(struct amnt_data) + 1);
++
++ if (resp_buf == NULL) {
++ wpa_printf(MSG_ERROR, "Error in memory allocation\n");
++ return -1;
++ }
++
++ if (hostapd_drv_amnt_dump(hapd, amnt_idx, (u8 *)resp_buf)) {
++ wpa_printf(MSG_ERROR, "Not able to set amnt index\n");
++ os_free(resp_buf);
++ return -1;
++ }
++
++ for (int i = 0; i < resp_buf->sta_num && i < AIR_MONITOR_MAX_ENTRY; i++) {
++ res = &resp_buf->resp_data[i];
++ ret = os_snprintf(pos, end - pos,
++ "[hostapd_cli] amnt_idx: %d, addr="MACSTR
++ ", rssi=%d/%d/%d/%d, last_seen=%u\n",
++ res->idx,
++ MAC2STR(res->addr), res->rssi[0],
++ res->rssi[1], res->rssi[2],
++ res->rssi[3], res->last_seen);
++ if (os_snprintf_error(end - pos, ret)) {
++ os_free(resp_buf);
++ return 0;
++ }
++ pos = pos + ret;
++ }
++
++ os_free(resp_buf);
++
++ if (pos == buf)
++ return os_snprintf(buf, buflen, "Index %d is not monitored\n",
++ amnt_idx);
++ else
++ return pos - buf;
++}
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -4392,6 +4499,12 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_len = hostapd_ctrl_iface_ap_wireless(hapd, buf + 12, reply, reply_size);
+ } else if (os_strncmp(buf, "ap_rfeatures ", 13) == 0) {
+ reply_len = hostapd_ctrl_iface_ap_rfeatures(hapd, buf + 13, reply, reply_size);
++ } else if (os_strncmp(buf, "SET_AMNT", 8) == 0) {
++ reply_len = hostapd_ctrl_iface_set_amnt(hapd, buf+9,
++ reply, reply_size);
++ } else if (os_strncmp(buf, "DUMP_AMNT", 9) == 0) {
++ reply_len = hostapd_ctrl_iface_dump_amnt(hapd, buf+10,
++ reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index aad7aa5..0c4a176 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1613,6 +1613,17 @@ static int hostapd_cli_cmd_get_amsdu(struct wpa_ctrl *ctrl, int argc,
+ return hostapd_cli_cmd(ctrl, "GET_AMSDU", 0, NULL, NULL);
+ }
+
++static int hostapd_cli_cmd_set_amnt(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "SET_AMNT", 2, argc, argv);
++}
++
++static int hostapd_cli_cmd_dump_amnt(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "DUMP_AMNT", 1, argc, argv);
++}
+
+ struct hostapd_cli_cmd {
+ const char *cmd;
+@@ -1823,6 +1834,10 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ " = show iBF state (enabled/disabled)"},
+ { "get_amsdu", hostapd_cli_cmd_get_amsdu, NULL,
+ " = show AMSDU state"},
++ { "set_amnt", hostapd_cli_cmd_set_amnt, NULL,
++ " = Set Station index and mac to monitor"},
++ { "dump_amnt", hostapd_cli_cmd_dump_amnt, NULL,
++ " = Dump RSSI of monitoring Station"},
+ { NULL, NULL, NULL, NULL }
+ };
+
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 52d0fff..eafa588 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1121,3 +1121,17 @@ int hostapd_drv_ap_trig_type(struct hostapd_data *hapd, u8 enable, u8 type)
+ return 0;
+ return hapd->driver->ap_trigtype(hapd->drv_priv, enable, type);
+ }
++
++int hostapd_drv_amnt_set(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_sta_mac)
++{
++ if (!hapd->driver || !hapd->driver->amnt_set)
++ return 0;
++ return hapd->driver->amnt_set(hapd->drv_priv, amnt_idx, amnt_sta_mac);
++}
++
++int hostapd_drv_amnt_dump(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_dump_buf)
++{
++ if (!hapd->driver || !hapd->driver->amnt_dump)
++ return 0;
++ return hapd->driver->amnt_dump(hapd->drv_priv, amnt_idx, amnt_dump_buf);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 659c3f8..28f2a4d 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -155,6 +155,9 @@ int hostapd_drv_ap_wireless(struct hostapd_data *hapd, u8 sub_vendor_id, int val
+ int hostapd_drv_ap_rfeatures(struct hostapd_data *hapd, u8 sub_vendor_id, int value);
+ int hostapd_drv_ap_trig_type(struct hostapd_data *hapd, u8 enable, u8 type);
+
++int hostapd_drv_amnt_set(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_sta_mac);
++int hostapd_drv_amnt_dump(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_dump_buf);
++
+ #include "drivers/driver.h"
+
+ int hostapd_drv_wnm_oper(struct hostapd_data *hapd,
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 32438af..74f467c 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -256,10 +256,18 @@ struct csi_data {
+ u16 rx_idx;
+ };
+
++#define AIR_MONITOR_MAX_ENTRY 16
++
+ struct amnt_data {
+ u8 idx;
+ u8 addr[ETH_ALEN];
+ s8 rssi[4];
+ u32 last_seen;
+ };
++
++struct amnt_resp_data {
++ u8 sta_num;
++ struct amnt_data resp_data[0];
++};
++
+ #endif /* MTK_VENDOR_H */
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 6a46832..1444cbe 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4809,6 +4809,22 @@ struct wpa_driver_ops {
+ * @type: trigger type
+ */
+ int (*ap_trigtype)(void *priv, u8 enable, u8 type);
++
++ /**
++ * amnt_set - add/delete station from monitoring
++ * @priv: Private driver interface data
++ * @amnt_idx: Monitor Index
++ * @amnt_sta_mac: station mac address
++ */
++ int (*amnt_set)(void *priv, u8 amnt_idx, u8 *amnt_sta_mac);
++
++ /**
++ * amnt_dump - Dump particular/ all station
++ * @priv: Private driver interface data
++ * @amnt_idx: Monitor Index
++ * @amnt_dump_buf: Buffer to print
++ */
++ int (*amnt_dump)(void *priv, u8 amnt_idx, u8 *amnt_dump_buf);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 7fae013..0470079 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -125,6 +125,19 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
+ [MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
+ };
+
++static struct nla_policy
++amnt_ctrl_policy[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL] = {
++ [MTK_VENDOR_ATTR_AMNT_CTRL_SET] = {.type = NLA_NESTED },
++ [MTK_VENDOR_ATTR_AMNT_CTRL_DUMP] = { .type = NLA_NESTED },
++};
++
++static struct nla_policy
++amnt_dump_policy[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP] = {
++ [MTK_VENDOR_ATTR_AMNT_DUMP_INDEX] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_AMNT_DUMP_LEN] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_AMNT_DUMP_RESULT] = { .type = NLA_NESTED },
++};
++
+ static struct nl_sock * nl_create_handle(struct nl_cb *cb, const char *dbg)
+ {
+ struct nl_sock *handle;
+@@ -13196,6 +13209,171 @@ fail:
+ return -ENOBUFS;
+ }
+
++static int
++nl80211_amnt_set(void *priv, u8 amnt_idx, u8 *amnt_sta_mac)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ void *tb1;
++ int ret;
++
++ if (!drv->mtk_amnt_vendor_cmd_avail) {
++ wpa_printf(MSG_ERROR,
++ "nl80211: Driver does not support air monitor");
++ return 0;
++ }
++
++ msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
++ if (!data)
++ goto fail;
++
++ tb1 = nla_nest_start(msg, MTK_VENDOR_ATTR_AMNT_CTRL_SET);
++ if (!tb1)
++ goto fail;
++
++ nla_put_u8(msg, MTK_VENDOR_ATTR_AMNT_SET_INDEX, amnt_idx);
++
++ nla_put(msg, MTK_VENDOR_ATTR_AMNT_SET_MACADDR, ETH_ALEN, amnt_sta_mac);
++
++ nla_nest_end(msg, tb1);
++ nla_nest_end(msg, data);
++
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++
++ if (ret)
++ wpa_printf(MSG_ERROR, "Failed to set air monitor. ret=%d (%s)",
++ ret, strerror(-ret));
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++
++}
++
++static int
++mt76_amnt_dump_cb(struct nl_msg *msg, void *arg)
++{
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb1[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL];
++ struct nlattr *tb2[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP];
++ struct nlattr *attr, *cur, *data;
++ struct amnt_data *res;
++ int len = 0, rem;
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct amnt_resp_data *amnt_dump = (struct amnt_resp_data *)arg;
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ attr = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!attr)
++ return NL_SKIP;
++
++ nla_parse_nested(tb1, MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
++ attr, amnt_ctrl_policy);
++
++ if (!tb1[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP])
++ return NL_SKIP;
++
++ nla_parse_nested(tb2, NUM_MTK_VENDOR_ATTRS_AMNT_DUMP,
++ tb1[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP], amnt_dump_policy);
++
++ if (!tb2[MTK_VENDOR_ATTR_AMNT_DUMP_LEN])
++ return NL_SKIP;
++
++ len = nla_get_u8(tb2[MTK_VENDOR_ATTR_AMNT_DUMP_LEN]);
++ if (!len)
++ return 0;
++
++ if (!tb2[MTK_VENDOR_ATTR_AMNT_DUMP_RESULT])
++ return NL_SKIP;
++
++ data = tb2[MTK_VENDOR_ATTR_AMNT_DUMP_RESULT];
++
++ nla_for_each_nested(cur, data, rem) {
++ if (amnt_dump->sta_num >= AIR_MONITOR_MAX_ENTRY)
++ return NL_SKIP;
++ res = (struct amnt_data *) nla_data(cur);
++ wpa_printf(MSG_ERROR, "[vendor] amnt_idx: %d, "
++ "addr="MACSTR", "
++ "rssi=%d/%d/%d/%d, last_seen=%u\n",
++ res->idx,
++ MAC2STR(res->addr),
++ res->rssi[0], res->rssi[1], res->rssi[2],
++ res->rssi[3], res->last_seen);
++ os_memcpy(&amnt_dump->resp_data[amnt_dump->sta_num], res,
++ sizeof(struct amnt_data));
++ amnt_dump->sta_num++;
++ }
++ return 0;
++}
++
++static int
++nl80211_amnt_dump(void *priv, u8 amnt_idx, u8 *dump_buf)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ void *tb1;
++ int ret;
++
++ if (!drv->mtk_amnt_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support air monitor");
++ return 0;
++ }
++
++ msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
++ if (!data)
++ goto fail;
++
++ tb1 = nla_nest_start(msg, MTK_VENDOR_ATTR_AMNT_CTRL_DUMP
++ | NLA_F_NESTED);
++ if (!tb1)
++ goto fail;
++
++ nla_put_u8(msg, MTK_VENDOR_ATTR_AMNT_DUMP_INDEX, amnt_idx);
++
++ nla_nest_end(msg, tb1);
++ nla_nest_end(msg, data);
++
++ ret = send_and_recv_msgs(drv, msg, mt76_amnt_dump_cb,
++ dump_buf, NULL, NULL);
++
++ if (ret)
++ wpa_printf(MSG_ERROR, "Failed to Dump air monitor. ret=%d (%s)"
++ , ret, strerror(-ret));
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+ .desc = "Linux nl80211/cfg80211",
+@@ -13356,4 +13534,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .ap_wireless = nl80211_ap_wireless,
+ .ap_rfeatures = nl80211_ap_rfeatures,
+ .ap_trigtype = nl80211_ap_trigtype,
++ .amnt_set = nl80211_amnt_set,
++ .amnt_dump = nl80211_amnt_dump,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 7a03446..7dd88e7 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -188,6 +188,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int mtk_wireless_vendor_cmd_avail:1;
+ unsigned int mtk_bss_color_vendor_cmd_avail:1;
+ unsigned int mtk_rfeatures_vendor_cmd_avail:1;
++ unsigned int mtk_amnt_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 6f4d029..5c1a35d 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1094,6 +1094,8 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ break;
+ case MTK_NL80211_VENDOR_SUBCMD_BSS_COLOR_CTRL :
+ drv->mtk_bss_color_vendor_cmd_avail = 1;
++ case MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL:
++ drv->mtk_amnt_vendor_cmd_avail = 1;
+ break;
+ case MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL:
+ drv->mtk_rfeatures_vendor_cmd_avail = 1;
+--
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
index 90c3ba0..f5475c8 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
@@ -88,6 +88,7 @@
file://mtk-0024-hostapd-mtk-Add-support-for-masking-EHT-capabilities.patch \
file://mtk-0025-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch \
file://mtk-0026-hostapd-mtk-Add-vendor-for-CAPI-certification-comman.patch \
+ file://mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch \
file://mtk-0027-hostapd-mtk-Fix-scan-result-updating-issue.patch \
file://mtk-0100-hostapd-mtk-update-eht-operation-elem.patch \
"
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch
new file mode 100644
index 0000000..59a0bc5
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch
@@ -0,0 +1,506 @@
+From 8496882339b6e9dc550b491693b8029fc88ac191 Mon Sep 17 00:00:00 2001
+From: mtk23888 <dipanshu.mittal@mediatek.com>
+Date: Tue, 4 Apr 2023 13:06:41 +0800
+Subject: [PATCH] Air Monitor support in hostapd by vendor NL
+
+Signed-off-by: mtk23888 <dipanshu.mittal@mediatek.com>
+---
+ hostapd/ctrl_iface.c | 113 +++++++++++++++++++
+ hostapd/hostapd_cli.c | 15 +++
+ src/ap/ap_drv_ops.c | 14 +++
+ src/ap/ap_drv_ops.h | 3 +
+ src/common/mtk_vendor.h | 8 ++
+ src/drivers/driver.h | 16 +++
+ src/drivers/driver_nl80211.c | 180 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h | 1 +
+ src/drivers/driver_nl80211_capa.c | 2 +
+ 9 files changed, 352 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index f338d0f..7f91cb6 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3765,6 +3765,44 @@ hostapd_ctrl_iface_ap_wireless(struct hostapd_data *hapd, char *cmd,
+
+ if (hostapd_drv_ap_wireless(hapd, (u8) sub_cmd, atoi(value)) != 0)
+ return -1;
++ return os_snprintf(buf, buflen, "OK\n");
++}
++
++static int
++hostapd_ctrl_iface_set_amnt(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *tmp, sta_mac[ETH_ALEN] = {0};
++ int amnt_idx = 0;
++
++ tmp = strtok_r(cmd, " ", &cmd);
++
++ if (!tmp) {
++ wpa_printf(MSG_ERROR, "Error in command format\n");
++ return -1;
++ }
++
++ amnt_idx = strtol(tmp, &tmp, 10);
++
++ if (amnt_idx < 0 || amnt_idx > 15) {
++ wpa_printf(MSG_ERROR, "Wrong AMNT index %d\n", amnt_idx);
++ return -1;
++ }
++
++ if (!cmd) {
++ wpa_printf(MSG_ERROR, "Error in command format\n");
++ return -1;
++ }
++
++ if (hwaddr_aton(cmd, sta_mac) < 0) {
++ wpa_printf(MSG_ERROR, "station mac is not right.\n");
++ return -1;
++ }
++
++ if (hostapd_drv_amnt_set(hapd, amnt_idx, sta_mac)) {
++ wpa_printf(MSG_ERROR, "Not able to set amnt index\n");
++ return -1;
++ }
+
+ return os_snprintf(buf, buflen, "OK\n");
+ }
+@@ -3818,6 +3856,75 @@ exit:
+ return os_snprintf(buf, buflen, "OK\n");
+ }
+
++static int
++hostapd_ctrl_iface_dump_amnt(struct hostapd_data *hapd, char *cmd,
++ char *buf, size_t buflen)
++{
++ char *tmp;
++ int amnt_idx = 0, ret = 0;
++ struct amnt_resp_data *resp_buf;
++ char *pos, *end;
++ struct amnt_data *res;
++
++ pos = buf;
++ end = buf + buflen;
++
++ tmp = strtok_r(cmd, " ", &cmd);
++
++ if (!tmp) {
++ wpa_printf(MSG_ERROR, "Error in command format\n");
++ return -1;
++ }
++
++ amnt_idx = strtoul(tmp, &tmp, 0);
++
++ if ((amnt_idx < 0 || amnt_idx > 15) && amnt_idx != 0xff) {
++ wpa_printf(MSG_ERROR, "Wrong AMNT index\n");
++ return -1;
++ }
++
++ if (amnt_idx == 0xff)
++ resp_buf = (struct amnt_resp_data *) os_zalloc(AIR_MONITOR_MAX_ENTRY
++ * sizeof(struct amnt_data) + 1);
++ else
++ resp_buf = (struct amnt_resp_data *) os_zalloc(sizeof(struct amnt_data) + 1);
++
++ if (resp_buf == NULL) {
++ wpa_printf(MSG_ERROR, "Error in memory allocation\n");
++ return -1;
++ }
++
++ if (hostapd_drv_amnt_dump(hapd, amnt_idx, (u8 *)resp_buf)) {
++ wpa_printf(MSG_ERROR, "Not able to set amnt index\n");
++ os_free(resp_buf);
++ return -1;
++ }
++
++ for (int i = 0; i < resp_buf->sta_num && i < AIR_MONITOR_MAX_ENTRY; i++) {
++ res = &resp_buf->resp_data[i];
++ ret = os_snprintf(pos, end - pos,
++ "[hostapd_cli] amnt_idx: %d, addr="MACSTR
++ ", rssi=%d/%d/%d/%d, last_seen=%u\n",
++ res->idx,
++ MAC2STR(res->addr), res->rssi[0],
++ res->rssi[1], res->rssi[2],
++ res->rssi[3], res->last_seen);
++ if (os_snprintf_error(end - pos, ret)) {
++ os_free(resp_buf);
++ return 0;
++ }
++ pos = pos + ret;
++ }
++
++ os_free(resp_buf);
++
++ if (pos == buf)
++ return os_snprintf(buf, buflen, "Index %d is not monitored\n",
++ amnt_idx);
++ else
++ return pos - buf;
++}
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ char *buf, char *reply,
+ int reply_size,
+@@ -4392,6 +4499,12 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ reply_len = hostapd_ctrl_iface_ap_wireless(hapd, buf + 12, reply, reply_size);
+ } else if (os_strncmp(buf, "ap_rfeatures ", 13) == 0) {
+ reply_len = hostapd_ctrl_iface_ap_rfeatures(hapd, buf + 13, reply, reply_size);
++ } else if (os_strncmp(buf, "SET_AMNT", 8) == 0) {
++ reply_len = hostapd_ctrl_iface_set_amnt(hapd, buf+9,
++ reply, reply_size);
++ } else if (os_strncmp(buf, "DUMP_AMNT", 9) == 0) {
++ reply_len = hostapd_ctrl_iface_dump_amnt(hapd, buf+10,
++ reply, reply_size);
+ } else {
+ os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index aad7aa5..0c4a176 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1613,6 +1613,17 @@ static int hostapd_cli_cmd_get_amsdu(struct wpa_ctrl *ctrl, int argc,
+ return hostapd_cli_cmd(ctrl, "GET_AMSDU", 0, NULL, NULL);
+ }
+
++static int hostapd_cli_cmd_set_amnt(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "SET_AMNT", 2, argc, argv);
++}
++
++static int hostapd_cli_cmd_dump_amnt(struct wpa_ctrl *ctrl, int argc,
++ char *argv[])
++{
++ return hostapd_cli_cmd(ctrl, "DUMP_AMNT", 1, argc, argv);
++}
+
+ struct hostapd_cli_cmd {
+ const char *cmd;
+@@ -1823,6 +1834,10 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ " = show iBF state (enabled/disabled)"},
+ { "get_amsdu", hostapd_cli_cmd_get_amsdu, NULL,
+ " = show AMSDU state"},
++ { "set_amnt", hostapd_cli_cmd_set_amnt, NULL,
++ " = Set Station index and mac to monitor"},
++ { "dump_amnt", hostapd_cli_cmd_dump_amnt, NULL,
++ " = Dump RSSI of monitoring Station"},
+ { NULL, NULL, NULL, NULL }
+ };
+
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 52d0fff..eafa588 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1121,3 +1121,17 @@ int hostapd_drv_ap_trig_type(struct hostapd_data *hapd, u8 enable, u8 type)
+ return 0;
+ return hapd->driver->ap_trigtype(hapd->drv_priv, enable, type);
+ }
++
++int hostapd_drv_amnt_set(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_sta_mac)
++{
++ if (!hapd->driver || !hapd->driver->amnt_set)
++ return 0;
++ return hapd->driver->amnt_set(hapd->drv_priv, amnt_idx, amnt_sta_mac);
++}
++
++int hostapd_drv_amnt_dump(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_dump_buf)
++{
++ if (!hapd->driver || !hapd->driver->amnt_dump)
++ return 0;
++ return hapd->driver->amnt_dump(hapd->drv_priv, amnt_idx, amnt_dump_buf);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 659c3f8..28f2a4d 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -155,6 +155,9 @@ int hostapd_drv_ap_wireless(struct hostapd_data *hapd, u8 sub_vendor_id, int val
+ int hostapd_drv_ap_rfeatures(struct hostapd_data *hapd, u8 sub_vendor_id, int value);
+ int hostapd_drv_ap_trig_type(struct hostapd_data *hapd, u8 enable, u8 type);
+
++int hostapd_drv_amnt_set(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_sta_mac);
++int hostapd_drv_amnt_dump(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_dump_buf);
++
+ #include "drivers/driver.h"
+
+ int hostapd_drv_wnm_oper(struct hostapd_data *hapd,
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 32438af..74f467c 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -256,10 +256,18 @@ struct csi_data {
+ u16 rx_idx;
+ };
+
++#define AIR_MONITOR_MAX_ENTRY 16
++
+ struct amnt_data {
+ u8 idx;
+ u8 addr[ETH_ALEN];
+ s8 rssi[4];
+ u32 last_seen;
+ };
++
++struct amnt_resp_data {
++ u8 sta_num;
++ struct amnt_data resp_data[0];
++};
++
+ #endif /* MTK_VENDOR_H */
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 6a46832..1444cbe 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4809,6 +4809,22 @@ struct wpa_driver_ops {
+ * @type: trigger type
+ */
+ int (*ap_trigtype)(void *priv, u8 enable, u8 type);
++
++ /**
++ * amnt_set - add/delete station from monitoring
++ * @priv: Private driver interface data
++ * @amnt_idx: Monitor Index
++ * @amnt_sta_mac: station mac address
++ */
++ int (*amnt_set)(void *priv, u8 amnt_idx, u8 *amnt_sta_mac);
++
++ /**
++ * amnt_dump - Dump particular/ all station
++ * @priv: Private driver interface data
++ * @amnt_idx: Monitor Index
++ * @amnt_dump_buf: Buffer to print
++ */
++ int (*amnt_dump)(void *priv, u8 amnt_idx, u8 *amnt_dump_buf);
+ };
+
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 7fae013..0470079 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -125,6 +125,19 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
+ [MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
+ };
+
++static struct nla_policy
++amnt_ctrl_policy[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL] = {
++ [MTK_VENDOR_ATTR_AMNT_CTRL_SET] = {.type = NLA_NESTED },
++ [MTK_VENDOR_ATTR_AMNT_CTRL_DUMP] = { .type = NLA_NESTED },
++};
++
++static struct nla_policy
++amnt_dump_policy[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP] = {
++ [MTK_VENDOR_ATTR_AMNT_DUMP_INDEX] = {.type = NLA_U8 },
++ [MTK_VENDOR_ATTR_AMNT_DUMP_LEN] = { .type = NLA_U8 },
++ [MTK_VENDOR_ATTR_AMNT_DUMP_RESULT] = { .type = NLA_NESTED },
++};
++
+ static struct nl_sock * nl_create_handle(struct nl_cb *cb, const char *dbg)
+ {
+ struct nl_sock *handle;
+@@ -13196,6 +13209,171 @@ fail:
+ return -ENOBUFS;
+ }
+
++static int
++nl80211_amnt_set(void *priv, u8 amnt_idx, u8 *amnt_sta_mac)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ void *tb1;
++ int ret;
++
++ if (!drv->mtk_amnt_vendor_cmd_avail) {
++ wpa_printf(MSG_ERROR,
++ "nl80211: Driver does not support air monitor");
++ return 0;
++ }
++
++ msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
++ if (!data)
++ goto fail;
++
++ tb1 = nla_nest_start(msg, MTK_VENDOR_ATTR_AMNT_CTRL_SET);
++ if (!tb1)
++ goto fail;
++
++ nla_put_u8(msg, MTK_VENDOR_ATTR_AMNT_SET_INDEX, amnt_idx);
++
++ nla_put(msg, MTK_VENDOR_ATTR_AMNT_SET_MACADDR, ETH_ALEN, amnt_sta_mac);
++
++ nla_nest_end(msg, tb1);
++ nla_nest_end(msg, data);
++
++ ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++
++ if (ret)
++ wpa_printf(MSG_ERROR, "Failed to set air monitor. ret=%d (%s)",
++ ret, strerror(-ret));
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++
++}
++
++static int
++mt76_amnt_dump_cb(struct nl_msg *msg, void *arg)
++{
++ struct nlattr *tb[NL80211_ATTR_MAX + 1];
++ struct nlattr *tb1[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL];
++ struct nlattr *tb2[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP];
++ struct nlattr *attr, *cur, *data;
++ struct amnt_data *res;
++ int len = 0, rem;
++ struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++ struct amnt_resp_data *amnt_dump = (struct amnt_resp_data *)arg;
++
++ nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++ genlmsg_attrlen(gnlh, 0), NULL);
++
++ attr = tb[NL80211_ATTR_VENDOR_DATA];
++ if (!attr)
++ return NL_SKIP;
++
++ nla_parse_nested(tb1, MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
++ attr, amnt_ctrl_policy);
++
++ if (!tb1[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP])
++ return NL_SKIP;
++
++ nla_parse_nested(tb2, NUM_MTK_VENDOR_ATTRS_AMNT_DUMP,
++ tb1[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP], amnt_dump_policy);
++
++ if (!tb2[MTK_VENDOR_ATTR_AMNT_DUMP_LEN])
++ return NL_SKIP;
++
++ len = nla_get_u8(tb2[MTK_VENDOR_ATTR_AMNT_DUMP_LEN]);
++ if (!len)
++ return 0;
++
++ if (!tb2[MTK_VENDOR_ATTR_AMNT_DUMP_RESULT])
++ return NL_SKIP;
++
++ data = tb2[MTK_VENDOR_ATTR_AMNT_DUMP_RESULT];
++
++ nla_for_each_nested(cur, data, rem) {
++ if (amnt_dump->sta_num >= AIR_MONITOR_MAX_ENTRY)
++ return NL_SKIP;
++ res = (struct amnt_data *) nla_data(cur);
++ wpa_printf(MSG_ERROR, "[vendor] amnt_idx: %d, "
++ "addr="MACSTR", "
++ "rssi=%d/%d/%d/%d, last_seen=%u\n",
++ res->idx,
++ MAC2STR(res->addr),
++ res->rssi[0], res->rssi[1], res->rssi[2],
++ res->rssi[3], res->last_seen);
++ os_memcpy(&amnt_dump->resp_data[amnt_dump->sta_num], res,
++ sizeof(struct amnt_data));
++ amnt_dump->sta_num++;
++ }
++ return 0;
++}
++
++static int
++nl80211_amnt_dump(void *priv, u8 amnt_idx, u8 *dump_buf)
++{
++ struct i802_bss *bss = priv;
++ struct wpa_driver_nl80211_data *drv = bss->drv;
++ struct nl_msg *msg;
++ struct nlattr *data;
++ void *tb1;
++ int ret;
++
++ if (!drv->mtk_amnt_vendor_cmd_avail) {
++ wpa_printf(MSG_INFO,
++ "nl80211: Driver does not support air monitor");
++ return 0;
++ }
++
++ msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++ if (!msg)
++ goto fail;
++
++ if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++ nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++ MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL))
++ goto fail;
++
++ data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
++ if (!data)
++ goto fail;
++
++ tb1 = nla_nest_start(msg, MTK_VENDOR_ATTR_AMNT_CTRL_DUMP
++ | NLA_F_NESTED);
++ if (!tb1)
++ goto fail;
++
++ nla_put_u8(msg, MTK_VENDOR_ATTR_AMNT_DUMP_INDEX, amnt_idx);
++
++ nla_nest_end(msg, tb1);
++ nla_nest_end(msg, data);
++
++ ret = send_and_recv_msgs(drv, msg, mt76_amnt_dump_cb,
++ dump_buf, NULL, NULL);
++
++ if (ret)
++ wpa_printf(MSG_ERROR, "Failed to Dump air monitor. ret=%d (%s)"
++ , ret, strerror(-ret));
++
++ return ret;
++
++fail:
++ nlmsg_free(msg);
++ return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .name = "nl80211",
+ .desc = "Linux nl80211/cfg80211",
+@@ -13356,4 +13534,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ .ap_wireless = nl80211_ap_wireless,
+ .ap_rfeatures = nl80211_ap_rfeatures,
+ .ap_trigtype = nl80211_ap_trigtype,
++ .amnt_set = nl80211_amnt_set,
++ .amnt_dump = nl80211_amnt_dump,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 7a03446..7dd88e7 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -188,6 +188,7 @@ struct wpa_driver_nl80211_data {
+ unsigned int mtk_wireless_vendor_cmd_avail:1;
+ unsigned int mtk_bss_color_vendor_cmd_avail:1;
+ unsigned int mtk_rfeatures_vendor_cmd_avail:1;
++ unsigned int mtk_amnt_vendor_cmd_avail:1;
+
+ u64 vendor_scan_cookie;
+ u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 6f4d029..5c1a35d 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1094,6 +1094,8 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ break;
+ case MTK_NL80211_VENDOR_SUBCMD_BSS_COLOR_CTRL :
+ drv->mtk_bss_color_vendor_cmd_avail = 1;
++ case MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL:
++ drv->mtk_amnt_vendor_cmd_avail = 1;
+ break;
+ case MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL:
+ drv->mtk_rfeatures_vendor_cmd_avail = 1;
+--
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/patches.inc b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
index 775c230..addbce2 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
@@ -88,5 +88,6 @@
file://mtk-0024-hostapd-mtk-Add-support-for-masking-EHT-capabilities.patch \
file://mtk-0025-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch \
file://mtk-0026-hostapd-mtk-Add-vendor-for-CAPI-certification-comman.patch \
+ file://mtk-0027-hostapd-mtk-Add-support-for-air-monitor-from-vendor-NL.patch \
file://mtk-0027-hostapd-mtk-Fix-scan-result-updating-issue.patch \
"