diff --git a/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
new file mode 100644
index 0000000..e9b5544
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
@@ -0,0 +1,27 @@
+From ad3c58a67fd28755ae75ac995ae404eb5c6c21b0 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Tue, 18 Jan 2022 20:29:44 +0800
+Subject: [PATCH 900/908] mac80211: mtk: do not setup twt when twt responder is
+ false
+
+---
+ net/mac80211/rx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index ba21e7c..02a0387 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3298,6 +3298,9 @@ ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
+ 	if (sdata->vif.type != NL80211_IFTYPE_AP)
+ 		return false;
+ 
++	if (!sdata->vif.bss_conf.twt_responder)
++		return false;
++
+ 	if (!rx->local->ops->add_twt_setup)
+ 		return false;
+ 
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
new file mode 100644
index 0000000..57d18b4
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
@@ -0,0 +1,32 @@
+From 7b24c04be43656f0d305473119ba534a5720bc47 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 29 Mar 2022 16:06:30 +0800
+Subject: [PATCH 901/908] nl80211: mtk: extend CAC time for weather radar
+ channels
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ net/wireless/nl80211.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 84bf9e8..d3b03ab 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -9807,6 +9807,13 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
+ 	if (WARN_ON(!cac_time_ms))
+ 		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+ 
++	if ((dfs_region == NL80211_DFS_ETSI) &&
++	    (((chandef.width == NL80211_CHAN_WIDTH_160) &&
++	     (chandef.center_freq2 >= 5580 && chandef.center_freq2 <= 5640)) ||
++	    (chandef.center_freq1 >= 5580 && chandef.center_freq1 <= 5640)))
++		cac_time_ms = 600000;
++	pr_info("%s: region = %u, cetner freq1 = %u, center freq2 = %u, cac time ms = %u\n", __func__, dfs_region, chandef.center_freq1, chandef.center_freq2, cac_time_ms);
++
+ 	err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
+ 	if (!err) {
+ 		wdev->links[0].ap.chandef = chandef;
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
new file mode 100644
index 0000000..46a18f7
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
@@ -0,0 +1,28 @@
+From e66fda08e681b11aa6a10bd7fd750d210cb22745 Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Fri, 1 Apr 2022 09:15:21 +0800
+Subject: [PATCH 902/908] mac80211: mtk: it's invalid case when frag_threshold
+ is greater than 2346
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ net/wireless/nl80211.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index d3b03ab..aa04e11 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3615,6 +3615,9 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
+ 			goto out;
+ 		}
+ 
++		if (frag_threshold >= 2346)
++			frag_threshold = (u32) -1;
++
+ 		if (frag_threshold != (u32) -1) {
+ 			/*
+ 			 * Fragments (apart from the last one) are required to
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/903-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/903-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
new file mode 100644
index 0000000..0f72cb9
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/903-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
@@ -0,0 +1,30 @@
+From 9556fba48d305893fa27e6f0765c1e7985ac734c Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Wed, 19 Oct 2022 13:42:43 +0800
+Subject: [PATCH 903/908] mac80211: mtk: airtime_flags depends on
+ NL80211_EXT_FEATURE
+
+Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+---
+ net/mac80211/main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 83a1482..f6fb626 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -804,8 +804,9 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
+ 			IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H;
+ 		atomic_set(&local->aql_ac_pending_airtime[i], 0);
+ 	}
+-
+-	local->airtime_flags = AIRTIME_USE_TX | AIRTIME_USE_RX;
++	if (wiphy_ext_feature_isset(local->hw.wiphy,
++			NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
++		local->airtime_flags = AIRTIME_USE_TX | AIRTIME_USE_RX;
+ 	local->aql_threshold = IEEE80211_AQL_THRESHOLD;
+ 	atomic_set(&local->aql_total_pending_airtime, 0);
+ 
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/904-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/904-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
new file mode 100644
index 0000000..cb7dbde
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/904-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
@@ -0,0 +1,182 @@
+From 2b41cfa0a72422f95b4c69be8141bb8579a87450 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Wed, 19 Oct 2022 13:45:42 +0800
+Subject: [PATCH 904/908] mac80211: mtk: add support for runtime set inband
+ discovery
+
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+---
+ include/net/cfg80211.h       |  1 +
+ include/net/mac80211.h       |  1 +
+ include/uapi/linux/nl80211.h |  1 +
+ net/mac80211/cfg.c           | 33 ++++++++++++++++++++++++++++++++-
+ net/wireless/nl80211.c       | 31 +++++++++++++++++++++++++++----
+ 5 files changed, 62 insertions(+), 5 deletions(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 118cd40..9728bf8 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -1268,6 +1268,7 @@ struct cfg80211_fils_discovery {
+ 	u32 max_interval;
+ 	size_t tmpl_len;
+ 	const u8 *tmpl;
++	u8 disable;
+ };
+ 
+ /**
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 6b16d6c..4485cfa 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -525,6 +525,7 @@ struct ieee80211_ftm_responder_params {
+ struct ieee80211_fils_discovery {
+ 	u32 min_interval;
+ 	u32 max_interval;
++	u8 disable;
+ };
+ 
+ /**
+diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
+index ba4aa09..1293d30 100644
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -7504,6 +7504,7 @@ enum nl80211_fils_discovery_attributes {
+ 	NL80211_FILS_DISCOVERY_ATTR_INT_MIN,
+ 	NL80211_FILS_DISCOVERY_ATTR_INT_MAX,
+ 	NL80211_FILS_DISCOVERY_ATTR_TMPL,
++	NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
+ 
+ 	/* keep last */
+ 	__NL80211_FILS_DISCOVERY_ATTR_LAST,
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index c15e72d..cd5444e 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -983,6 +983,7 @@ static int ieee80211_set_fils_discovery(struct ieee80211_sub_if_data *sdata,
+ 	fd = &link_conf->fils_discovery;
+ 	fd->min_interval = params->min_interval;
+ 	fd->max_interval = params->max_interval;
++	fd->disable = params->disable;
+ 
+ 	old = sdata_dereference(link->u.ap.fils_discovery, sdata);
+ 	new = kzalloc(sizeof(*new) + params->tmpl_len, GFP_KERNEL);
+@@ -1403,6 +1404,9 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
+ 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ 	struct ieee80211_link_data *link;
+ 	struct beacon_data *old;
++	struct cfg80211_ap_settings *ap_params;
++	struct ieee80211_supported_band *sband;
++	u32 changed;
+ 	int err;
+ 	struct ieee80211_bss_conf *link_conf;
+ 
+@@ -1434,7 +1438,34 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
+ 		err |= BSS_CHANGED_HE_BSS_COLOR;
+ 	}
+ 
+-	ieee80211_link_info_change_notify(sdata, link, err);
++	changed = err;
++
++	sband = ieee80211_get_sband(sdata);
++	if (!sband)
++		return -EINVAL;
++
++	if (sband->band == NL80211_BAND_6GHZ) {
++		ap_params = container_of(params, struct cfg80211_ap_settings, beacon);
++
++		if(ap_params->unsol_bcast_probe_resp.interval) {
++			err = ieee80211_set_unsol_bcast_probe_resp(sdata,
++								   &ap_params->unsol_bcast_probe_resp,
++								   link, link_conf);
++			if (err < 0)
++				return err;
++			changed |= BSS_CHANGED_UNSOL_BCAST_PROBE_RESP;
++		} else {
++			err = ieee80211_set_fils_discovery(sdata,
++							   &ap_params->fils_discovery,
++							   link, link_conf);
++
++			if (err < 0)
++				return err;
++			changed |= BSS_CHANGED_FILS_DISCOVERY;
++		}
++	}
++
++	ieee80211_bss_info_change_notify(sdata, changed);
+ 	return 0;
+ }
+ 
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index aa04e11..202f802 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -423,6 +423,7 @@ nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
+ 	[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
+ 	[NL80211_FILS_DISCOVERY_ATTR_TMPL] =
+ 			NLA_POLICY_BINARY_RANGE(NL80211_FILS_DISCOVERY_TMPL_MIN_LEN, IEEE80211_MAX_DATA_LEN),
++	[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE] = NLA_POLICY_MAX(NLA_U32, 20),
+ };
+ 
+ static const struct nla_policy
+@@ -5603,6 +5604,8 @@ static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
+ 	fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
+ 	fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
+ 	fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
++	fd->disable = !(fd->max_interval ||
++			nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE]));
+ 
+ 	return 0;
+ }
+@@ -6082,7 +6085,8 @@ static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
+ 	unsigned int link_id = nl80211_link_id(info->attrs);
+ 	struct net_device *dev = info->user_ptr[1];
+ 	struct wireless_dev *wdev = dev->ieee80211_ptr;
+-	struct cfg80211_beacon_data params;
++	struct cfg80211_ap_settings ap_params;
++	struct cfg80211_beacon_data *params;
+ 	int err;
+ 
+ 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+@@ -6095,16 +6099,35 @@ static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
+ 	if (!wdev->links[link_id].ap.beacon_interval)
+ 		return -EINVAL;
+ 
+-	err = nl80211_parse_beacon(rdev, info->attrs, &params);
++	memset(&ap_params, 0, sizeof(ap_params));
++	params = &ap_params.beacon;
++
++	err = nl80211_parse_beacon(rdev, info->attrs, params);
+ 	if (err)
+ 		goto out;
+ 
++	if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
++		err = nl80211_parse_fils_discovery(rdev,
++			   info->attrs[NL80211_ATTR_FILS_DISCOVERY],
++			   &ap_params);
++		if (err)
++			goto out;
++	}
++
++	if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
++		err = nl80211_parse_unsol_bcast_probe_resp(rdev,
++			   info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
++			   &ap_params);
++		if (err)
++			goto out;
++	}
++
+ 	wdev_lock(wdev);
+-	err = rdev_change_beacon(rdev, dev, &params);
++	err = rdev_change_beacon(rdev, dev, params);
+ 	wdev_unlock(wdev);
+ 
+ out:
+-	kfree(params.mbssid_ies);
++	kfree(params->mbssid_ies);
+ 	return err;
+ }
+ 
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/905-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/905-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
new file mode 100644
index 0000000..86125b4
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/905-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
@@ -0,0 +1,35 @@
+From deb128a1f5fba61b131394729373e51a7afd0ec6 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Wed, 19 Oct 2022 13:49:21 +0800
+Subject: [PATCH 905/908] mac80211: mtk: remove timerout handle for ax210 iot
+ issue
+
+Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+---
+ net/mac80211/agg-tx.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+ mode change 100644 => 100755 net/mac80211/agg-tx.c
+
+diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
+old mode 100644
+new mode 100755
+index 07c892a..1f46561
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -568,10 +568,9 @@ static void sta_tx_agg_session_timer_expired(struct timer_list *t)
+ 	}
+ 
+ 	timeout = tid_tx->last_tx + TU_TO_JIFFIES(tid_tx->timeout);
+-	if (time_is_after_jiffies(timeout)) {
+-		mod_timer(&tid_tx->session_timer, timeout);
+-		return;
+-	}
++	/* remove timerout handle for ax210 iot issue */
++	mod_timer(&tid_tx->session_timer, timeout);
++	return;
+ 
+ 	ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n",
+ 	       sta->sta.addr, tid);
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/906-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/906-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
new file mode 100644
index 0000000..f1b0542
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/906-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
@@ -0,0 +1,459 @@
+From e9dbde98d01f963121febafa51f6e7bb68bef135 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 22 Sep 2022 14:27:41 +0800
+Subject: [PATCH 906/908] cfg80211: mtk: implement DFS status show, cac and nop
+ skip command via debugfs
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ include/net/cfg80211.h  |   1 +
+ net/mac80211/cfg.c      |  20 +++
+ net/wireless/core.h     |   3 +
+ net/wireless/debugfs.c  | 270 ++++++++++++++++++++++++++++++++++++++--
+ net/wireless/mlme.c     |   6 +
+ net/wireless/rdev-ops.h |  14 +++
+ net/wireless/trace.h    |  12 ++
+ 7 files changed, 319 insertions(+), 7 deletions(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 9728bf8..f9c2cc3 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4641,6 +4641,7 @@ struct cfg80211_ops {
+ 				    struct link_station_parameters *params);
+ 	int	(*del_link_station)(struct wiphy *wiphy, struct net_device *dev,
+ 				    struct link_station_del_parameters *params);
++	void	(*skip_cac)(struct wireless_dev *wdev);
+ };
+ 
+ /*
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index cd5444e..5718c56 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4870,6 +4870,25 @@ ieee80211_del_link_station(struct wiphy *wiphy, struct net_device *dev,
+ 	return ret;
+ }
+ 
++static void
++ieee80211_skip_cac(struct wireless_dev *wdev)
++{
++	struct net_device *dev = wdev->netdev;
++	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++	struct cfg80211_chan_def chandef = sdata->deflink.conf->chandef;
++	unsigned int cac_time_ms;
++
++	cancel_delayed_work(&sdata->deflink.dfs_cac_timer_work);
++	if (wdev->cac_started) {
++		ieee80211_link_release_channel(&sdata->deflink);
++		cac_time_ms = wdev->cac_time_ms;
++		wdev->cac_start_time = jiffies -
++				       msecs_to_jiffies(cac_time_ms + 1);
++		cfg80211_cac_event(wdev->netdev, &chandef,
++				   NL80211_RADAR_CAC_FINISHED, GFP_KERNEL);
++	}
++}
++
+ const struct cfg80211_ops mac80211_config_ops = {
+ 	.add_virtual_intf = ieee80211_add_iface,
+ 	.del_virtual_intf = ieee80211_del_iface,
+@@ -4981,4 +5000,5 @@ const struct cfg80211_ops mac80211_config_ops = {
+ 	.add_link_station = ieee80211_add_link_station,
+ 	.mod_link_station = ieee80211_mod_link_station,
+ 	.del_link_station = ieee80211_del_link_station,
++	.skip_cac = ieee80211_skip_cac,
+ };
+diff --git a/net/wireless/core.h b/net/wireless/core.h
+index f4d3b83..b1bc314 100644
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -86,6 +86,9 @@ struct cfg80211_registered_device {
+ 
+ 	struct wireless_dev *background_radar_wdev;
+ 	struct cfg80211_chan_def background_radar_chandef;
++	bool background_cac_started;
++	unsigned long background_cac_start_time;
++	unsigned int background_cac_time_ms;
+ 	struct delayed_work background_cac_done_wk;
+ 	struct work_struct background_cac_abort_wk;
+ 
+diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
+index 0878b16..e0fcb59 100644
+--- a/net/wireless/debugfs.c
++++ b/net/wireless/debugfs.c
+@@ -9,6 +9,7 @@
+ #include <linux/slab.h>
+ #include "core.h"
+ #include "debugfs.h"
++#include "rdev-ops.h"
+ 
+ #define DEBUGFS_READONLY_FILE(name, buflen, fmt, value...)		\
+ static ssize_t name## _read(struct file *file, char __user *userbuf,	\
+@@ -96,16 +97,271 @@ static const struct file_operations ht40allow_map_ops = {
+ 	.llseek = default_llseek,
+ };
+ 
+-#define DEBUGFS_ADD(name)						\
+-	debugfs_create_file(#name, 0444, phyd, &rdev->wiphy, &name## _ops)
++static int dfs_print_chan(struct ieee80211_channel *chan, int remain_time, int wait_time,
++			  char *buf, int buf_size, int offset, bool is_background)
++{
++	if (WARN_ON(offset > buf_size))
++		return 0;
++
++	if (chan->dfs_state == NL80211_DFS_UNAVAILABLE) {
++		offset += scnprintf(buf + offset, buf_size - offset,
++				    "	Channel = %d, DFS_state = Unavailable",
++				    chan->hw_value);
++		if (remain_time > 0)
++			offset += scnprintf(buf + offset, buf_size - offset,
++					    ", Non-occupancy Remain Time = %d / %d [sec]",
++					    remain_time, wait_time);
++		else
++			offset += scnprintf(buf + offset, buf_size - offset,
++					    ", Changing state...");
++	} else if (chan->dfs_state == NL80211_DFS_USABLE) {
++		offset += scnprintf(buf + offset, buf_size - offset,
++				    "	Channel = %d, DFS_state = Usable",
++				    chan->hw_value);
++		if (remain_time > 0)
++			offset += scnprintf(buf + offset, buf_size - offset,
++					    ", CAC Remain Time = %d / %d [sec]",
++					    remain_time, wait_time);
++	} else if (chan->dfs_state == NL80211_DFS_AVAILABLE) {
++		offset += scnprintf(buf + offset, buf_size - offset,
++				    "	Channel = %d, DFS_state = Available",
++				    chan->hw_value);
++	} else {
++		offset += scnprintf(buf + offset, buf_size - offset,
++				    "	Channel = %d, DFS_state = Unknown",
++				    chan->hw_value);
++	}
++
++	if (is_background)
++		offset += scnprintf(buf + offset, buf_size - offset,
++				    " (background chain)");
++	offset += scnprintf(buf + offset, buf_size - offset, "\n");
++
++	return offset;
++}
++
++static int dfs_status_read_wdev(struct wiphy *wiphy, struct wireless_dev *wdev, char *buf,
++				unsigned int buf_size, unsigned int offset)
++{
++	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++	struct cfg80211_chan_def *chandef = &wdev->links[0].ap.chandef;
++	struct cfg80211_chan_def *background_chandef = &rdev->background_radar_chandef;
++	enum nl80211_band band;
++	struct ieee80211_supported_band *sband;
++	struct ieee80211_channel *chan;
++	unsigned long jiffies_passed;
++	int i, remain_time = 0, wait_time_ms = 0;
++	bool is_background;
++
++	offset += scnprintf(buf + offset, buf_size - offset, "DFS Channel:\n");
++
++	for (band = 0; band < NUM_NL80211_BANDS; band++) {
++		sband = wiphy->bands[band];
++		if (!sband)
++			continue;
++		for (i = 0; i < sband->n_channels; i++) {
++			is_background = false;
++			chan = &sband->channels[i];
++
++			if (!(chan->flags & IEEE80211_CHAN_RADAR))
++				continue;
++
++			if (chan->dfs_state == NL80211_DFS_UNAVAILABLE) {
++				jiffies_passed = jiffies - chan->dfs_state_entered;
++				wait_time_ms = IEEE80211_DFS_MIN_NOP_TIME_MS;
++				remain_time = (wait_time_ms - jiffies_to_msecs(jiffies_passed));
++				if (remain_time > wait_time_ms)
++					remain_time = 0;
++			} else if (chan->dfs_state == NL80211_DFS_USABLE) {
++				if (wdev->cac_started && cfg80211_is_sub_chan(chandef, chan, false)) {
++					jiffies_passed = jiffies - wdev->cac_start_time;
++					wait_time_ms = wdev->cac_time_ms;
++					remain_time = (wait_time_ms -
++						       jiffies_to_msecs(jiffies_passed));
++				}
++
++				if (rdev->background_radar_wdev == wdev &&
++				    rdev->background_cac_started &&
++				    cfg80211_is_sub_chan(background_chandef, chan, false)) {
++					jiffies_passed = jiffies - rdev->background_cac_start_time;
++					wait_time_ms = rdev->background_cac_time_ms;
++					remain_time = (wait_time_ms -
++						       jiffies_to_msecs(jiffies_passed));
++					is_background = true;
++				}
++
++				if (remain_time > wait_time_ms)
++					remain_time = 0;
++
++			} else {
++				if (rdev->background_radar_wdev == wdev &&
++				    cfg80211_is_sub_chan(background_chandef, chan, false))
++					is_background = true;
++			}
++
++			offset = dfs_print_chan(chan, remain_time / 1000, wait_time_ms / 1000,
++						buf, buf_size, offset, is_background);
++			remain_time = 0;
++		}
++	}
++
++	return offset;
++}
++
++static ssize_t dfs_status_read(struct file *file, char __user *user_buf,
++			       size_t count, loff_t *ppos)
++{
++	struct wiphy *wiphy = file->private_data;
++	struct wireless_dev *wdev;
++	char *buf;
++	unsigned int offset = 0, buf_size = PAGE_SIZE, r;
++	const char * const iftype_str[] = {
++		[NL80211_IFTYPE_UNSPECIFIED] = "unspecified",
++		[NL80211_IFTYPE_ADHOC] = "adhoc",
++		[NL80211_IFTYPE_STATION] = "station",
++		[NL80211_IFTYPE_AP] = "ap",
++		[NL80211_IFTYPE_AP_VLAN] = "ap vlan",
++		[NL80211_IFTYPE_WDS] = "wds",
++		[NL80211_IFTYPE_MONITOR] = "monitor",
++		[NL80211_IFTYPE_MESH_POINT] = "mesh point",
++		[NL80211_IFTYPE_P2P_CLIENT] = "p2p client",
++		[NL80211_IFTYPE_P2P_GO] = "p2p go",
++		[NL80211_IFTYPE_P2P_DEVICE] = "p2p device",
++		[NL80211_IFTYPE_OCB] = "ocb",
++		[NL80211_IFTYPE_NAN] = "nan",
++	};
++
++	buf = kzalloc(buf_size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	list_for_each_entry(wdev, &wiphy->wdev_list, list) {
++		offset += scnprintf(buf + offset, buf_size - offset,
++				    "wdev 0x%x\n"
++				    "interface type %s\n",
++				    wdev->identifier, iftype_str[wdev->iftype]);
++		offset = dfs_status_read_wdev(wiphy, wdev, buf, buf_size, offset);
++	}
++
++	r = simple_read_from_buffer(user_buf, count, ppos, buf, offset);
++
++	kfree(buf);
++
++	return r;
++}
++
++static const struct file_operations dfs_status_ops = {
++	.read = dfs_status_read,
++	.open = simple_open,
++	.llseek = default_llseek,
++};
++
++static int
++dfs_nop_skip(void *data, u64 val)
++{
++	struct wiphy *wiphy = data;
++	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++	bool en = !!val;
++	enum nl80211_band band;
++	struct ieee80211_supported_band *sband;
++	struct ieee80211_channel *chan;
++	u32 nop_time = IEEE80211_DFS_MIN_NOP_TIME_MS;
++	int i;
++
++	if (!en)
++		return 0;
++
++	for (band = 0; band < NUM_NL80211_BANDS; band++) {
++		sband = wiphy->bands[band];
++		if (!sband)
++			continue;
++		for (i = 0; i < sband->n_channels; i++) {
++			chan = &sband->channels[i];
++
++			if (!(chan->flags & IEEE80211_CHAN_RADAR))
++				continue;
++
++			if (chan->dfs_state == NL80211_DFS_UNAVAILABLE) {
++				// Let current jiffies > dfs_state_entered_jiffies + NOP time
++				chan->dfs_state_entered = jiffies -
++						       msecs_to_jiffies(nop_time + 1);
++			}
++		}
++	}
++
++	cfg80211_sched_dfs_chan_update(rdev);
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(dfs_skip_nop_ops, NULL,
++			 dfs_nop_skip, "0x%08llx\n");
++
++static int
++dfs_cac_skip(void *data, u64 val)
++{
++#define CAC_SKIP_MASK			BIT(0)
++#define CAC_SKIP_BACKGROUND_MASK	BIT(1)
++	struct wiphy *wiphy = data;
++	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++	struct wireless_dev *wdev;
++	struct cfg80211_chan_def *chandef;
++	unsigned int skip_mode = val;
++	unsigned long cac_time;
++	struct ieee80211_channel *chan;
++
++	if (!skip_mode || skip_mode > (CAC_SKIP_MASK | CAC_SKIP_BACKGROUND_MASK))
++		return 0;
++
++	list_for_each_entry(wdev, &wiphy->wdev_list, list) {
++		if ((skip_mode & CAC_SKIP_MASK) && wdev->links[0].ap.chandef.chan) {
++			chandef = &wdev->links[0].ap.chandef;
++			chan = chandef->chan;
++
++			if ((chan->flags & IEEE80211_CHAN_RADAR) &&
++			    chan->dfs_state == NL80211_DFS_USABLE && wdev->cac_started) {
++				rdev_skip_cac(rdev, wdev);
++			}
++		}
++
++		if ((skip_mode & CAC_SKIP_BACKGROUND_MASK) &&
++		    rdev->background_radar_wdev == wdev &&
++		    rdev->background_radar_chandef.chan) {
++			chandef = &rdev->background_radar_chandef;
++			chan = chandef->chan;
++
++			if ((chan->flags & IEEE80211_CHAN_RADAR) &&
++			    chan->dfs_state == NL80211_DFS_USABLE &&
++			    rdev->background_cac_started) {
++				// Let current jiffies > dfs_state_entered_jiffies + CAC time
++				cac_time = rdev->background_cac_time_ms;
++				rdev->background_cac_start_time = jiffies -
++								  msecs_to_jiffies(cac_time + 1);
++				cancel_delayed_work(&rdev->background_cac_done_wk);
++				queue_delayed_work(cfg80211_wq, &rdev->background_cac_done_wk, 0);
++			}
++		}
++	}
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(dfs_skip_cac_ops, NULL,
++			 dfs_cac_skip, "0x%08llx\n");
++
++#define DEBUGFS_ADD(name, chmod)						\
++	debugfs_create_file(#name, chmod, phyd, &rdev->wiphy, &name## _ops)
+ 
+ void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev)
+ {
+ 	struct dentry *phyd = rdev->wiphy.debugfsdir;
+ 
+-	DEBUGFS_ADD(rts_threshold);
+-	DEBUGFS_ADD(fragmentation_threshold);
+-	DEBUGFS_ADD(short_retry_limit);
+-	DEBUGFS_ADD(long_retry_limit);
+-	DEBUGFS_ADD(ht40allow_map);
++	DEBUGFS_ADD(rts_threshold, 0444);
++	DEBUGFS_ADD(fragmentation_threshold, 0444);
++	DEBUGFS_ADD(short_retry_limit, 0444);
++	DEBUGFS_ADD(long_retry_limit, 0444);
++	DEBUGFS_ADD(ht40allow_map, 0444);
++	DEBUGFS_ADD(dfs_status, 0444);
++	DEBUGFS_ADD(dfs_skip_nop, 0600);
++	DEBUGFS_ADD(dfs_skip_cac, 0600);
+ }
+diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
+index 5a63dba..57b9bde 100644
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -1030,13 +1030,16 @@ __cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
+ 		queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
+ 		cfg80211_sched_dfs_chan_update(rdev);
+ 		wdev = rdev->background_radar_wdev;
++		rdev->background_cac_started = false;
+ 		break;
+ 	case NL80211_RADAR_CAC_ABORTED:
+ 		if (!cancel_delayed_work(&rdev->background_cac_done_wk))
+ 			return;
+ 		wdev = rdev->background_radar_wdev;
++		rdev->background_cac_started = false;
+ 		break;
+ 	case NL80211_RADAR_CAC_STARTED:
++		rdev->background_cac_started = true;
+ 		break;
+ 	default:
+ 		return;
+@@ -1056,6 +1059,7 @@ cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
+ 					chandef, event);
+ 	wiphy_unlock(&rdev->wiphy);
+ }
++EXPORT_SYMBOL(cfg80211_background_cac_event);
+ 
+ void cfg80211_background_cac_done_wk(struct work_struct *work)
+ {
+@@ -1117,8 +1121,10 @@ cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rde
+ 	if (!cac_time_ms)
+ 		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+ 
++	rdev->background_cac_time_ms = cac_time_ms;
+ 	rdev->background_radar_chandef = *chandef;
+ 	rdev->background_radar_wdev = wdev; /* Get offchain ownership */
++	rdev->background_cac_start_time = jiffies;
+ 
+ 	__cfg80211_background_cac_event(rdev, wdev, chandef,
+ 					NL80211_RADAR_CAC_STARTED);
+diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
+index ca29892..ce83152 100644
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -1494,4 +1494,18 @@ rdev_del_link_station(struct cfg80211_registered_device *rdev,
+ 	return ret;
+ }
+ 
++static inline int
++rdev_skip_cac(struct cfg80211_registered_device *rdev,
++	      struct wireless_dev *wdev)
++{
++	if (!rdev->ops->skip_cac)
++		return -EOPNOTSUPP;
++
++	trace_rdev_skip_cac(wdev);
++	rdev->ops->skip_cac(wdev);
++	trace_rdev_return_void(&rdev->wiphy);
++
++	return 0;
++}
++
+ #endif /* __CFG80211_RDEV_OPS */
+diff --git a/net/wireless/trace.h b/net/wireless/trace.h
+index 8e7c00f..d3a98e8 100644
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3901,6 +3901,18 @@ TRACE_EVENT(rdev_del_link_station,
+ 		  __entry->link_id)
+ );
+ 
++TRACE_EVENT(rdev_skip_cac,
++	    TP_PROTO(struct wireless_dev *wdev),
++
++	    TP_ARGS(wdev),
++
++	    TP_STRUCT__entry(WDEV_ENTRY),
++
++	    TP_fast_assign(WDEV_ASSIGN;),
++
++	    TP_printk(WDEV_PR_FMT, WDEV_PR_ARG)
++);
++
+ #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
+ 
+ #undef TRACE_INCLUDE_PATH
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/907-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/907-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
new file mode 100644
index 0000000..6f5adfd
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/907-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
@@ -0,0 +1,26 @@
+From 4781823ccaaca6cb075013aa8bbb2e733ddffb5f Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Tue, 4 Oct 2022 10:47:05 +0800
+Subject: [PATCH 907/908] mac80211: mtk: Set TWT Information Frame Disabled bit
+ as 1.
+
+This modification means that current implementation do not support twt information frame.
+---
+ net/mac80211/s1g.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/mac80211/s1g.c b/net/mac80211/s1g.c
+index c1f964e..d9d84db 100644
+--- a/net/mac80211/s1g.c
++++ b/net/mac80211/s1g.c
+@@ -101,6 +101,7 @@ ieee80211_s1g_rx_twt_setup(struct ieee80211_sub_if_data *sdata,
+ 	struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
+ 
+ 	twt_agrt->req_type &= cpu_to_le16(~IEEE80211_TWT_REQTYPE_REQUEST);
++	twt->control |= IEEE80211_TWT_CONTROL_RX_DISABLED;
+ 
+ 	/* broadcast TWT not supported yet */
+ 	if (twt->control & IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST) {
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/908-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/908-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
new file mode 100644
index 0000000..fdb863e
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/908-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
@@ -0,0 +1,262 @@
+From 5fcae1d998339e7d0632c8ae5781232f9e6e4b14 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Wed, 5 Oct 2022 19:13:43 +0800
+Subject: [PATCH 908/908] mac80211: mtk: fix the issue of AP and STA starting
+ on DFS channel concurrently
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ include/net/cfg80211.h       | 22 ++++++++++++++++++
+ include/uapi/linux/nl80211.h |  2 +-
+ net/mac80211/cfg.c           | 44 ++++++++++++++++++++++++++++++++++++
+ net/mac80211/chan.c          |  2 +-
+ net/wireless/chan.c          |  6 ++---
+ net/wireless/nl80211.c       |  8 +++++++
+ net/wireless/rdev-ops.h      | 16 +++++++++++++
+ net/wireless/trace.h         | 15 ++++++++++++
+ 8 files changed, 110 insertions(+), 5 deletions(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index f9c2cc3..84e769b 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -888,6 +888,24 @@ cfg80211_chandef_identical(const struct cfg80211_chan_def *chandef1,
+ 		chandef1->center_freq2 == chandef2->center_freq2);
+ }
+ 
++/**
++ * cfg80211_chan_fully_overlap - check if two channel are fully overlapped
++ * @chandef1: first channel definition
++ * @chandef2: second channel definition
++ *
++ * Return: %true if the channels are valid and fully overlapped, %false otherwise.
++ */
++static inline bool
++cfg80211_chan_fully_overlap(const struct cfg80211_chan_def *chandef1,
++			    const struct cfg80211_chan_def *chandef2)
++{
++	return (chandef1->center_freq1 != 0 &&
++		chandef1->center_freq1 == chandef2->center_freq1 &&
++		chandef1->width == chandef2->width &&
++		chandef1->freq1_offset == chandef2->freq1_offset &&
++		chandef1->center_freq2 == chandef2->center_freq2);
++}
++
+ /**
+  * cfg80211_chandef_is_edmg - check if chandef represents an EDMG channel
+  *
+@@ -4642,6 +4660,8 @@ struct cfg80211_ops {
+ 	int	(*del_link_station)(struct wiphy *wiphy, struct net_device *dev,
+ 				    struct link_station_del_parameters *params);
+ 	void	(*skip_cac)(struct wireless_dev *wdev);
++	void	(*check_cac_skip)(struct wiphy *wiphy,
++				  struct cfg80211_chan_def *chandef);
+ };
+ 
+ /*
+@@ -5847,6 +5867,8 @@ struct wireless_dev {
+ 		};
+ 	} links[IEEE80211_MLD_MAX_NUM_LINKS];
+ 	u16 valid_links;
++
++	bool start_disabled;
+ };
+ 
+ static inline const u8 *wdev_address(struct wireless_dev *wdev)
+diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
+index 1293d30..db9d0a8 100644
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -3283,7 +3283,7 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
+ 
+ 	/* add attributes here, update the policy in nl80211.c */
+-
++	NL80211_ATTR_START_DISABLED = 999,
+ 	__NL80211_ATTR_AFTER_LAST,
+ 	NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
+ 	NL80211_ATTR_MAX = __NL80211_ATTR_AFTER_LAST - 1
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 5718c56..9da02d9 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4889,6 +4889,49 @@ ieee80211_skip_cac(struct wireless_dev *wdev)
+ 	}
+ }
+ 
++static void
++ieee80211_check_cac_skip(struct wiphy *wiphy,
++			 struct cfg80211_chan_def *chandef)
++{
++	struct ieee80211_local *local = wiphy_priv(wiphy);
++	struct ieee80211_sub_if_data *s1;
++	struct ieee80211_sub_if_data *s2;
++	struct ieee80211_sub_if_data *sdata_sta;
++	struct ieee80211_if_managed *ifmgd;
++	struct ieee80211_channel *chan;
++	struct wireless_dev *wdev;
++	unsigned int cac_time_ms;
++
++	mutex_lock(&local->mtx);
++	/* Bypass AP's cac if there is a STA associated to the same DFS channel */
++	list_for_each_entry(s1, &local->interfaces, list) {
++		ifmgd = &s1->u.mgd;
++
++		if (s1->vif.type == NL80211_IFTYPE_STATION && ifmgd->associated)
++			sdata_sta = s1;
++		else
++			continue;
++
++		list_for_each_entry(s2, &local->interfaces, list) {
++			wdev = &s2->wdev;
++			chan = wdev->links[0].ap.chandef.chan;
++			if (chan) {
++				if (!(chan->flags & IEEE80211_CHAN_RADAR))
++					continue;
++
++				if (wdev->identifier != sdata_sta->wdev.identifier &&
++				    chan->dfs_state == NL80211_DFS_USABLE && wdev->cac_started &&
++				    cfg80211_chan_fully_overlap(&sdata_sta->vif.bss_conf.chandef,
++								&s2->vif.bss_conf.chandef)) {
++					ieee80211_skip_cac(wdev);
++					sdata_info(s2, "Skip CAC on the associated STA's chan\n");
++				}
++			}
++		}
++	}
++	mutex_unlock(&local->mtx);
++}
++
+ const struct cfg80211_ops mac80211_config_ops = {
+ 	.add_virtual_intf = ieee80211_add_iface,
+ 	.del_virtual_intf = ieee80211_del_iface,
+@@ -5001,4 +5044,5 @@ const struct cfg80211_ops mac80211_config_ops = {
+ 	.mod_link_station = ieee80211_mod_link_station,
+ 	.del_link_station = ieee80211_del_link_station,
+ 	.skip_cac = ieee80211_skip_cac,
++	.check_cac_skip = ieee80211_check_cac_skip,
+ };
+diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
+index e72cf07..94496d7 100644
+--- a/net/mac80211/chan.c
++++ b/net/mac80211/chan.c
+@@ -567,7 +567,7 @@ bool ieee80211_is_radar_required(struct ieee80211_local *local)
+ 
+ 			link = rcu_dereference(sdata->link[link_id]);
+ 
+-			if (link && link->radar_required) {
++			if (link && link->radar_required && sdata->wdev.cac_started) {
+ 				rcu_read_unlock();
+ 				return true;
+ 			}
+diff --git a/net/wireless/chan.c b/net/wireless/chan.c
+index 29b5c2f..bf21f99 100644
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -719,16 +719,16 @@ bool cfg80211_beaconing_iface_active(struct wireless_dev *wdev)
+ 	case NL80211_IFTYPE_AP:
+ 	case NL80211_IFTYPE_P2P_GO:
+ 		for_each_valid_link(wdev, link) {
+-			if (wdev->links[link].ap.beacon_interval)
++			if (wdev->links[link].ap.beacon_interval || wdev->start_disabled)
+ 				return true;
+ 		}
+ 		break;
+ 	case NL80211_IFTYPE_ADHOC:
+-		if (wdev->u.ibss.ssid_len)
++		if (wdev->u.ibss.ssid_len || wdev->start_disabled)
+ 			return true;
+ 		break;
+ 	case NL80211_IFTYPE_MESH_POINT:
+-		if (wdev->u.mesh.id_len)
++		if (wdev->u.mesh.id_len || wdev->start_disabled)
+ 			return true;
+ 		break;
+ 	case NL80211_IFTYPE_STATION:
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 202f802..7ce76e7 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -789,6 +789,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ 			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
+ 	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
+ 	[NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
++	[NL80211_ATTR_START_DISABLED] = { .type = NLA_FLAG },
+ 	[NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
+ 	[NL80211_ATTR_EHT_CAPABILITY] =
+ 		NLA_POLICY_BINARY_RANGE(NL80211_EHT_MIN_CAPABILITY_LEN, NL80211_EHT_MAX_CAPABILITY_LEN),
+@@ -5803,6 +5804,12 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
+ 	if (wdev->links[link_id].ap.beacon_interval)
+ 		return -EALREADY;
+ 
++	if (info->attrs[NL80211_ATTR_START_DISABLED]) {
++		wdev->start_disabled = nla_get_flag(info->attrs[NL80211_ATTR_START_DISABLED]);
++		err = 0;
++		goto out;
++	}
++
+ 	/* these are required for START_AP */
+ 	if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
+ 	    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
+@@ -9846,6 +9853,7 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
+ 		wdev->cac_started = true;
+ 		wdev->cac_start_time = jiffies;
+ 		wdev->cac_time_ms = cac_time_ms;
++		err = rdev_check_cac_skip(rdev, &wdev->links[0].ap.chandef);
+ 	}
+ unlock:
+ 	wiphy_unlock(wiphy);
+diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
+index ce83152..ffa504a 100644
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -1508,4 +1508,20 @@ rdev_skip_cac(struct cfg80211_registered_device *rdev,
+ 	return 0;
+ }
+ 
++static inline int
++rdev_check_cac_skip(struct cfg80211_registered_device *rdev,
++		    struct cfg80211_chan_def *chandef)
++{
++	struct wiphy *wiphy = &rdev->wiphy;
++
++	if (!rdev->ops->check_cac_skip)
++		return -EOPNOTSUPP;
++
++	trace_rdev_check_cac_skip(wiphy, chandef);
++	rdev->ops->check_cac_skip(wiphy, chandef);
++	trace_rdev_return_void(wiphy);
++
++	return 0;
++}
++
+ #endif /* __CFG80211_RDEV_OPS */
+diff --git a/net/wireless/trace.h b/net/wireless/trace.h
+index d3a98e8..72c8f0e 100644
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3913,6 +3913,21 @@ TRACE_EVENT(rdev_skip_cac,
+ 	    TP_printk(WDEV_PR_FMT, WDEV_PR_ARG)
+ );
+ 
++TRACE_EVENT(rdev_check_cac_skip,
++	    TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
++
++	    TP_ARGS(wiphy, chandef),
++
++	    TP_STRUCT__entry(WIPHY_ENTRY
++			     CHAN_DEF_ENTRY),
++
++	    TP_fast_assign(WIPHY_ASSIGN;
++			   CHAN_DEF_ASSIGN(chandef)),
++
++	    TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
++		      WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
++);
++
+ #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
+ 
+ #undef TRACE_INCLUDE_PATH
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/99900-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/99900-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch
new file mode 100644
index 0000000..8ffd6f5
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/99900-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch
@@ -0,0 +1,158 @@
+From 447d620689b705b1e6e382a8bae59930e74e257c Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Wed, 18 May 2022 15:10:22 +0800
+Subject: [PATCH 99900/99901] mac80211: mtk: add fill receive path ops to get
+ wed idx
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ include/net/mac80211.h    | 15 +++++++++++++--
+ net/mac80211/driver-ops.h | 13 +++++++++++++
+ net/mac80211/iface.c      | 24 ++++++++++++++++++++++++
+ net/mac80211/util.c       |  9 +++++++++
+ 4 files changed, 59 insertions(+), 2 deletions(-)
+ mode change 100644 => 100755 net/mac80211/util.c
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 4485cfa..fe686a4 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1354,7 +1354,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
+  * @RX_FLAG_AMPDU_EOF_BIT_KNOWN: The EOF value is known
+  * @RX_FLAG_RADIOTAP_HE: HE radiotap data is present
+  *	(&struct ieee80211_radiotap_he, mac80211 will fill in
+- *	
++ *
+  *	 - DATA3_DATA_MCS
+  *	 - DATA3_DATA_DCM
+  *	 - DATA3_CODING
+@@ -1362,7 +1362,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
+  *	 - DATA5_DATA_BW_RU_ALLOC
+  *	 - DATA6_NSTS
+  *	 - DATA3_STBC
+- *	
++ *
+  *	from the RX info data, so leave those zeroed when building this data)
+  * @RX_FLAG_RADIOTAP_HE_MU: HE MU radiotap data is present
+  *	(&struct ieee80211_radiotap_he_mu)
+@@ -1911,6 +1911,12 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
+  */
+ struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif);
+ 
++/**
++ * ieee80211_vif_to_wdev - return a net_device struct from a vif
++ * @vif: the vif to get the net_device for
++ */
++struct net_device *ieee80211_vif_to_netdev(struct ieee80211_vif *vif);
++
+ /**
+  * lockdep_vif_mutex_held - for lockdep checks on link poiners
+  * @vif: the interface to check
+@@ -4173,6 +4179,8 @@ struct ieee80211_prep_tx_info {
+  *	Note that a sta can also be inserted or removed with valid links,
+  *	i.e. passed to @sta_add/@sta_state with sta->valid_links not zero.
+  *	In fact, cannot change from having valid_links and not having them.
++ * @net_fill_receive_path: Called from .ndo_fill_receive_path in order to
++ *	get a path for hardware flow offloading
+  */
+ struct ieee80211_ops {
+ 	void (*tx)(struct ieee80211_hw *hw,
+@@ -4528,6 +4536,9 @@ struct ieee80211_ops {
+ 				struct ieee80211_vif *vif,
+ 				struct ieee80211_sta *sta,
+ 				u16 old_links, u16 new_links);
++	int (*net_fill_receive_path)(struct ieee80211_hw *hw,
++				     struct net_device_path_ctx *ctx,
++				     struct net_device_path *path);
+ };
+ 
+ /**
+diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
+index 3d16b09..bbecd2e 100644
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1479,4 +1479,17 @@ int drv_change_sta_links(struct ieee80211_local *local,
+ 			 struct ieee80211_sta *sta,
+ 			 u16 old_links, u16 new_links);
+ 
++static inline int drv_net_fill_receive_path(struct ieee80211_local *local,
++					    struct net_device_path_ctx *ctx,
++					    struct net_device_path *path)
++{
++	int ret = -EOPNOTSUPP;
++
++	if (local->ops->net_fill_receive_path)
++		ret = local->ops->net_fill_receive_path(&local->hw,
++							ctx, path);
++
++	return ret;
++}
++
+ #endif /* __MAC80211_DRIVER_OPS */
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 674b749..af8d96b 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -918,6 +918,29 @@ out:
+ 	return ret;
+ }
+ 
++static int ieee80211_netdev_fill_receive_path(struct net_device_path_ctx *ctx,
++					      struct net_device_path *path)
++{
++	struct ieee80211_sub_if_data *sdata;
++	struct ieee80211_local *local;
++	int ret = -ENOENT;
++
++	sdata = IEEE80211_DEV_TO_SUB_IF(ctx->dev);
++	local = sdata->local;
++
++	if (!local->ops->net_fill_receive_path)
++		return -EOPNOTSUPP;
++
++	rcu_read_lock();
++
++	ret = drv_net_fill_receive_path(local, ctx, path);
++
++	rcu_read_unlock();
++
++	return ret;
++}
++
++
+ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+ 	.ndo_open		= ieee80211_open,
+ 	.ndo_stop		= ieee80211_stop,
+@@ -927,6 +950,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+ 	.ndo_set_mac_address	= ieee80211_change_mac,
+ 	.ndo_get_stats64	= ieee80211_get_stats64,
+ 	.ndo_fill_forward_path	= ieee80211_netdev_fill_forward_path,
++	.ndo_fill_receive_path = ieee80211_netdev_fill_receive_path,
+ };
+ 
+ static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+old mode 100644
+new mode 100755
+index 005a730..189ab8a
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -914,6 +914,15 @@ struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
+ }
+ EXPORT_SYMBOL_GPL(ieee80211_vif_to_wdev);
+ 
++struct net_device *ieee80211_vif_to_netdev(struct ieee80211_vif *vif)
++{
++	if (!vif)
++		return NULL;
++
++	return vif_to_sdata(vif)->dev;
++}
++EXPORT_SYMBOL_GPL(ieee80211_vif_to_netdev);
++
+ /*
+  * Nothing should have been stuffed into the workqueue during
+  * the suspend->resume cycle. Since we can't check each caller
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/99901-fix-build-failed.patch b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/99901-fix-build-failed.patch
new file mode 100644
index 0000000..6731827
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mac80211_dev/patches/subsys/99901-fix-build-failed.patch
@@ -0,0 +1,97 @@
+From 58619705cdbd28520ddf730eba94c3f5dfca04dc Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 12 Dec 2022 15:08:10 +0800
+Subject: [PATCH 99901/99901] fix build failed
+
+---
+ include/linux/ieee80211.h          | 8 +++-----
+ net/mac80211/rc80211_minstrel_ht.c | 2 ++
+ net/mac80211/wpa.c                 | 4 ++--
+ net/wireless/nl80211.c             | 4 ++++
+ 4 files changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index 7969093..6f70394 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -310,11 +310,9 @@ static inline u16 ieee80211_sn_sub(u16 sn1, u16 sn2)
+ struct ieee80211_hdr {
+ 	__le16 frame_control;
+ 	__le16 duration_id;
+-	struct_group(addrs,
+-		u8 addr1[ETH_ALEN];
+-		u8 addr2[ETH_ALEN];
+-		u8 addr3[ETH_ALEN];
+-	);
++	u8 addr1[ETH_ALEN];
++	u8 addr2[ETH_ALEN];
++	u8 addr3[ETH_ALEN];
+ 	__le16 seq_ctrl;
+ 	u8 addr4[ETH_ALEN];
+ } __packed __aligned(2);
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index 33001ec..277fec9 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -10,7 +10,9 @@
+ #include <linux/random.h>
+ #include <linux/moduleparam.h>
+ #include <linux/ieee80211.h>
++#if LINUX_VERSION_IS_GEQ(5,10,0)
+ #include <linux/minmax.h>
++#endif
+ #include <net/mac80211.h>
+ #include "rate.h"
+ #include "sta_info.h"
+diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
+index 20f742b..93ec2f3 100644
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -351,7 +351,7 @@ static u8 ccmp_gcmp_aad(struct sk_buff *skb, u8 *aad)
+ 	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
+ 	put_unaligned_be16(len_a, &aad[0]);
+ 	put_unaligned(mask_fc, (__le16 *)&aad[2]);
+-	memcpy(&aad[4], &hdr->addrs, 3 * ETH_ALEN);
++	memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
+ 
+ 	/* Mask Seq#, leave Frag# */
+ 	aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f;
+@@ -792,7 +792,7 @@ static void bip_aad(struct sk_buff *skb, u8 *aad)
+ 				IEEE80211_FCTL_MOREDATA);
+ 	put_unaligned(mask_fc, (__le16 *) &aad[0]);
+ 	/* A1 || A2 || A3 */
+-	memcpy(aad + 2, &hdr->addrs, 3 * ETH_ALEN);
++	memcpy(aad + 2, &hdr->addr1, 3 * ETH_ALEN);
+ }
+ 
+ 
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 7ce76e7..d6f836d 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -16449,9 +16449,11 @@ static const struct genl_ops nl80211_ops[] = {
+ 		/* can be retrieved by unprivileged users */
+ 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
+ 	},
++#if LINUX_VERSION_IS_GEQ(5,10,0)
+ };
+ 
+ static const struct genl_small_ops nl80211_small_ops[] = {
++#endif
+ 	{
+ 		.cmd = NL80211_CMD_SET_WIPHY,
+ 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+@@ -17288,8 +17290,10 @@ static struct genl_family nl80211_fam __genl_ro_after_init = {
+ 	.module = THIS_MODULE,
+ 	.ops = nl80211_ops,
+ 	.n_ops = ARRAY_SIZE(nl80211_ops),
++#if LINUX_VERSION_IS_GEQ(5,10,0)
+ 	.small_ops = nl80211_small_ops,
+ 	.n_small_ops = ARRAY_SIZE(nl80211_small_ops),
++#endif
+ #if LINUX_VERSION_IS_GEQ(6,1,0)
+ 	.resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
+ #endif
+-- 
+2.18.0
+